3

Recently I detected this CA on my phone:

enter image description here

It shocked me that the CA itself is called "Packet Capture CA" and so much information are blank.

Why does Android allowed such weird CA to exists?

Question is is there a official list of CA where I can verify its authenticity?

PS: For safety reason, I have immediately deleted this CA from my phone - but while doing this, I saw so many other CA with different weird names.

  • 1
    Well, for one thing, it looks like the certificate data was handwritten... – 0xdd Apr 19 '18 at 20:05
  • @Jules - I think the OP is just using a strange font. – Neil Smithline Apr 20 '18 at 0:55
  • i am using "Comic Sans" font. – Peter Teoh Jan 25 at 4:07
5

This CA is installed when installing the Packet Capture app from the play-store.

It's very likely that you've imported this Certificate yourself by installing the app somewhere in the past.

Further, there is no reason at all for Android to block any CA Certs based on the "weirdness" of a name. And it doesn't really make any sense to me why it should, as names can be chosen freely...

  • I see, so installing the app can lead to installation of a new certificate. And since the text/name can be arbitrary, it is always possible to duplicate and reuse someone's else name, but now you have a different public key. and since nobody read public key, you can be tricked into talking to someone unwanted. Not sure if I got wrong anywhere? – Peter Teoh Apr 19 '18 at 15:36
  • That is less or more theoretically correct, yes, allthough a thorough answer would require an in depth explanation of the role of CA's in the HTTPS pki. This is also the functionality of the Packet Capture application. You set up an SSL proxy, and import the CA on your client so you can decrypt the traffic between client and proxy. While this can be used for debugging and testing, it obviously could be used for malicious purposes. – Nomad Apr 19 '18 at 15:46
5

There are two types of CAs you can have on an android device.

  • One shipped with the operating system
  • One added by the user (you)

The displayed CA is added by you. This one in particular belongs to an app called Packet Capture, that allows you to capture and examine communications on your device. You probably installed it in the past. This is relatively safe, though you may want to remove it once you are done with the app.

The other "weird" certificates were most likely shipped with your phone. The Adnroid OS unfortunately shipps with way too many CAs pre-installed for no good reason as further described here. What I recommend is finding a list of CAs trusted by a major browser, such as Mozilla Firefox and disabling all other CAs. You will most likely not need the others, as you are doing fine without them on your PC/laptop and I also did not notice any problem so far.

  • 2
    "This is not dangerous." - Assuming you trust the Packet Capture app and its authors. – marcelm Apr 19 '18 at 17:30
  • Well, from what I understand, the certificate is locally generated and different for every device, which means the authors should never have access to this certificates private keys. Of course, you still have to trust them that this is actually what is happening, but the amount of trust is significantly smaller IMHO. Edited to address your concerns. – Peter Harmann Apr 19 '18 at 17:33
  • Fair enough, that actually improves the situation! It's still highly dangerous if the app leaks the private key for the certificate to somewhere (including the authors). And of course, the app itself can tamper with encrypted traffic. But that is of course understandable given the context for the app. Basically, I was being a bit pedantic... +1 for the edit though :) – marcelm Apr 20 '18 at 10:35

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.