2

I developed a stand alone application such a way that, application use a remote service (using SOAP/REST) which available WWW. I am using HTTPS though out the application calls. It was perfectly working fine. Recently I found that some users using a web proxy like Fiddler to sniff the application traffic and monitoring application WSDLs, request and responses. I introduced JWT(JSON Web Token) to prevent man in the middle attack, but again, JWT messages can be captured and decoded to see original requests and responses.

I found another way to protect application request and response is to encrypt individual packets before send using any symmetric key algorithms such as AES or zip up with AES encryption. But this will affect performance of the application badly.

Is there any other way to address this issue without affect much on application performance?

|improve this question|||||
  • You can read some SSL with Wireshark. wiki.wireshark.org/SSL – AbsoluteƵERØ Jun 14 '13 at 8:07
  • It's not clear to me whether you're trying to address attacks by trusted or untrusted users. It sounds like a legitimate user of your application is using Fiddler to see how your application works, and you prefer it to be a black box? This is a different case than if a third party is somehow leveraging a man-in-the-middle attack. The former case is hard because the application may be trusting the browser for all HTTPS goodness, and that would be what's allowing your user to Fiddle with it. Very difficult to protect an application from its users. – gowenfawr Jun 14 '13 at 13:59
  • Yes. I want to make my application to be a black box. Currently an untrusted user can be able to sniff my application traffic and he can modify the application generated request and response from server using fiddler. I want to block such scenarios and protect my application. – javad_shareef Jun 17 '13 at 5:10
4

If everything is made through HTTPS, all your application have to do is ensure the certificate is correct and valid.

Man in the middle attack can only decrypt HTTPS traffic by ruining the original certificate and issuing a [generally] self-signed one to the local peer communication.

|improve this answer|||||
  • So, what you are telling is to verify certificate genuineness from application right? As you said, fiddler provide self-signed certificate to the application. – javad_shareef Jun 14 '13 at 6:47
  • Exactly. And no web browser falls for that, because if its invalid, expired, self-signed or signed by some unknown certification authority, they stop the navigation immediately and throw the user a security warning. You only have to do about the same with your application. – Havenard Jun 14 '13 at 6:52
  • Will try to implement this. Do you have any suggestion for this, like things to be more prioritized? – javad_shareef Jun 14 '13 at 7:02

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.