0

We've been discussing a possible attack vector where a rogue app with root rights could hijack the legit ssl session of anther local app and transmit its own data over it without the server being able to detect it (Edit: our app uses ssl cert pinning).

  • What would the rogue app need to do to achieve that?
  • Are there any documented cases (especially for Android)?
  • How could we prevent this?

(I know, the rule of thumb is that there's no protection if the attacker has root access, but we wonder whether this was / could be exploited in a practical way)

Improve this question

2 Answers 2

Reset to default
1

It would be possible. The app could act as a ssl proxy. For example if you were to browse to google.com the ssl proxy app would retrieve googles ssl cert. The ssl proxy would then supply you with it's own generated ca certificate. This would generate a ssl warning in your browser. However if the app installed that it's own generated ca certificate to trusted root certificates it would display no ssl error. Therefore you would not detect your connection being hijacked. As for documented cases I haven't seen anything like this. I don't know enough about the android OS to prevent this but I'm sure there would be ways.

Improve this answer
1
  • We use SSL cert pinning our app, so this method should not be (too easily) possible. However, I would assume the ssl session information which has to be stored somewhere (even if in RAM) could be somehow hijacked too?
    – Bachi
    Mar 4, 2014 at 10:05
0

Adding to what Tim said, I believe you are completely safe as long as cert pinning is done correctly and the phone's OS is "trusted" (if phone is rooted all bets are off).

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .