I read this article today about an SSL MITM.

I am trying to understand this attack. This may be a naive question.

My understanding is that the WebView sends a request to domain name, the server sends down a X.509 certificate, which is invalid SSL certificate in this case, as the attacker might have already redirected the request to his own server. The WebView failed to identify this and accepted the SSL connection using the public key sent down and is now accepting code from attacker's server.

I want to know if the above explanation is correct given the details in the article.



From the article, yes, it's basically correct.

I would explain it in a simpler way, though: the client does not properly check the server certificate. This means that it doesn't check what server it is talking to and so anyone could impersonate that server.

There is a second vulnerability described which makes the first vulnerability even more serious: the client will happily execute javascript code sent by the server. Since the server is not checked, it means that anyone able to proxy or redirect the client to the IP of their choice will be able to execute javascript in on the client in the context of the paypal app. And since that paypal app also stores important information related to the owner's account in its preferences, it can be used almost directly to steal money from the paypal account in question.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.