1

My scenario:

  • I connected to an open WiFi at Kuala Lumpur Airport to read a news site from home (I know I was being absolutely careless).

  • I forgot to turn off sync on my Android phone, so all my apps "fired".

  • 2 minutes later I get a warning email from Google that someone knows my password and tried to log in from the Netherlands.

I would like to know how it was possible - is Android Gmail app susceptible to MITM + sslstrip attacks? If no, how else could it have happened? Does a well-configured VPN protect against such attacks?

  • So you never entered you password manually once when connected to the airport wifi? Did you set up any other email accounts besides Gmail? – Arminius May 20 '17 at 14:12
  • No captive portals on the network. 2 Gmail accounts, no other email accounts. P.S. it just occurred to me that gmail push notifications cannot be tunneled in VPN due to play services if I'm not mistaken, so my last question may or may not be a stupid question. – Itarill May 20 '17 at 14:16
3

SSL-strip is not an issue when you are using an app, it is only an issue when you are browsing the web through a browser. It works by replacing HTTPS links with HTTP links in an HTTP page. Since the URLs are hardcoded into an app, they can not be replaced by a MITM. So no need to worry about SSL-strip.

I have not been able to find an official statement, but I am pretty sure that the Gmail app uses TLS. Their webmail is only served over HTTPS, and other clients connecting to Gmail must use TLS. I find it hard to believe that they would make an exception for the Android app. So I would not worry about a MITM even if you're using public Wi-Fi.

Besides, I am not sure the app even uses the password - probably it uses some other kind of access token.

So how was your password stolen? I have no idea. Maybe you reused it on some other site? Maybe you entered it somewhere else? All I'm saying is that it was probably not sniffed from the Android app. Anyway, if you haven't already done it, you should change it.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.