1

I have run a heartbleed detector from Lookout on my Android phone. It says:

The version of openSSL is affected by the heartbleed bug but the vulnerable behaviour is not enabled.

What does it mean by not enabled?

I can see /system/lib/libssl.so file on the phone and found openssl on it. It shows 1.0.1c. Does that mean my phone is vulnerable to heartbleed bug?

My other question is: How I can check whether a particular Android app is vulnerable to heartbleed or not? I don't want to use any third party app. I have seen https://github.com/musalbas/heartbleed-masstest/blob/master/ssltest.py but I want to do it with an app. I don't know the domain name the app is communicating to. Are the app bundle the OpenSSL libraries with apk, If yes how to find the version of OpenSSL being used.

@Solution: I have wriiten python module which takes an APK and it do the check for openSSL version and heartbeat extension.

import zipfile
import os
import re

def heart_bleed(tempdir, msl_outputfile):
    parrent_tempdir = tempdir.split('tmp')[0]
    sslpattern = re.compile("1.0.1[a-f]")
    flagssl = False
    flagheartbleed = False

    msllst_heartbleed = []
    msc_vulid = "heartbleed"
    msc_infoseverity = "Info"
    msc_medseverity = "Medium"
    apkpath = ''
    if (parrent_tempdir):
        for root, dummy_dirs, files in os.walk(parrent_tempdir):
            for allfile in files:
                if allfile.endswith(".apk"):

                    apkpath = os.path.join(root, allfile)

        #print(apkpath)
        with zipfile.ZipFile(apkpath, "r") as msl_apkread:
            for i in msl_apkread.namelist():
                if i.endswith(".so"):
                    data = msl_apkread.read(i)
                    if "part of OpenSSL" in data:
                        start = data.index("part of OpenSSL")
                        resultdata = str(data[start:start+40])
                        sslversion = re.findall(sslpattern, resultdata)
                        if sslversion:
                            flagssl = True

                            if "tls1_heartbeat" in data:
                                flagheartbleed = True

        if flagssl and flagheartbleed:
            print("The App is using OpenSSL version " + sslversion[0] + " which is vulnerable to Heartbleed and Heartbeat extension is enabled."))
        elif flagssl or flagheartbleed:
            print("The App is using OpenSSL version " + sslversion[0] + " which is vulnerable to Heartbleed but Heartbeat extension is disabled."))

Please comment is it right to do ?

  • 1
    Say that you don't want to use a 3rd party app, but you want to use an app. That seems confusing and contradictory. – schroeder Jun 5 '14 at 21:45
  • Actually I want to make a tool which take and apk and check whether it is vulnerable to heart-bleed or not. – Roshan Mehta Jun 6 '14 at 14:22
  • Then you need to make this 2 questions: "Is my phone vulnerable or not?" and "How do I make my own app to check?" For the second question, you need to ask a different forum. – schroeder Jun 6 '14 at 14:26
  • This question keeps mutating. Please generate new questions for new questions. – schroeder Jun 11 '14 at 14:26
1

Heartbleed is a bug with the 'heartbeat' function within vulnerable versions of SSL. That's why the name 'heartbleed'. Your check is saying that your version is vulnerable, but the heartbeat function is not enabled.

  • How to find whether it is enable or not. I don't trust on any 3rd party app. – Roshan Mehta Jun 6 '14 at 14:23
0

The "SSL Heartbeat" function is an optional part of the OpenSSL library -- one that almost every copy of the library includes. It sounds like your phone is one of the few systems that chose not to include it.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.