I have run a heartbleed detector from Lookout on my Android phone. It says:
The version of openSSL is affected by the heartbleed bug but the vulnerable behaviour is not enabled.
What does it mean by not enabled?
I can see /system/lib/libssl.so file on the phone and found openssl on it. It shows 1.0.1c. Does that mean my phone is vulnerable to heartbleed bug?
My other question is: How I can check whether a particular Android app is vulnerable to heartbleed or not? I don't want to use any third party app. I have seen https://github.com/musalbas/heartbleed-masstest/blob/master/ssltest.py but I want to do it with an app. I don't know the domain name the app is communicating to. Are the app bundle the OpenSSL libraries with apk, If yes how to find the version of OpenSSL being used.
@Solution: I have wriiten python module which takes an APK and it do the check for openSSL version and heartbeat extension.
import zipfile import os import re def heart_bleed(tempdir, msl_outputfile): parrent_tempdir = tempdir.split('tmp') sslpattern = re.compile("1.0.1[a-f]") flagssl = False flagheartbleed = False msllst_heartbleed =  msc_vulid = "heartbleed" msc_infoseverity = "Info" msc_medseverity = "Medium" apkpath = '' if (parrent_tempdir): for root, dummy_dirs, files in os.walk(parrent_tempdir): for allfile in files: if allfile.endswith(".apk"): apkpath = os.path.join(root, allfile) #print(apkpath) with zipfile.ZipFile(apkpath, "r") as msl_apkread: for i in msl_apkread.namelist(): if i.endswith(".so"): data = msl_apkread.read(i) if "part of OpenSSL" in data: start = data.index("part of OpenSSL") resultdata = str(data[start:start+40]) sslversion = re.findall(sslpattern, resultdata) if sslversion: flagssl = True if "tls1_heartbeat" in data: flagheartbleed = True if flagssl and flagheartbleed: print("The App is using OpenSSL version " + sslversion + " which is vulnerable to Heartbleed and Heartbeat extension is enabled.")) elif flagssl or flagheartbleed: print("The App is using OpenSSL version " + sslversion + " which is vulnerable to Heartbleed but Heartbeat extension is disabled."))
Please comment is it right to do ?