Phone Applications having SSL/TLS enabled behind the scenes?

Question

Please Note: This question is slightly based on me being a tin foiled hat with the issues that has arisen from the leaks, documents, and questioning trust thanks to Edward Snowden.

---

Thanks to adding my VPN service to my cellphone to improve security and stop "eavesdropping" of Verizon on my data and usage, I am questioning the trust with Twitter, Facebook, Google, and all of the major social networking applications and how they are keeping our data secure as we access their applications.

There is no notice, information, or indication that they are using SSL/TLS within their applications for Android, Windows Phone, and iPhones.

Is Facebook, Twitter, Google Plus, and other major applications have SSL/TLS enabled and coded into their phone/tablet applications behind the scenes?

Answer 1

Short answer for your question is yes, most major (and official) social networking apps use encrypted connections. However, if you are interested, there are ways you can find out for yourself by setting up a proxy server that allows you to forward traffic through that system and then analyze the data. There are however, some tools to do this:

1- There is an Androguard extension called MalloDroid that

facilitates static code analysis of Android applications.

Specific details are as follows:

• Analyze the networking API calls, and extract valid HTTP(S) URLs from the decompiled apps
• Check the validity of the SSL certificates of all extracted HTTPS hosts.
• Identify apps containing API calls that differ from Android's default SSL usage, e.g., contain non-default trust managers, SSL socket factories or hostname verifiers with permissive verification strategies.

2- ZAP by Zscaler is a

web-based tool designed to streamline the capture and analysis of HTTP(S) traffic from mobile applications. ZAP is capable of analyzing traffic from both iOS and Android applications.

ZAP checks the following:

• Authentication: Username/password sent in clear text or using weak encoding methods.
• Device Metadata Leakage: Data that can identify an individual device, such as the Unique Device Identifier (UDID).
• Personally Identifiable Information Leakage: Data that can identify an individual user, such as an email address, phone number or mailing address.
• Exposed content: Communication with third parties such as advertising or analytics sites.

Sources:

http://www.techrepublic.com/blog/it-security/android-apps-and-ssl-wheres-the-padlock/

http://zap.zscaler.com/about.php

https://code.google.com/p/androguard/#Description

Answer 2

I asked myself this question two years ago, and I decided to see by myself. I set a lab with a MITM attack scenario and tested a couple of applications including Twitter and Whatsapp.

• The answer to your question: Yes most of these apps do use encrypted connections to transfer your data from your phone to their servers. Yet, remember once your data reaches them it is up to them to store it in the clear-text or encrypt it and then store it, or simply delete it!
• Another thing to note is the fact that these apps may fall into SSL-MITM attacks where an attacker generates his own certificate and sends it to the app claiming he is the server. Unless the app is programmed to reject such fake certs, anybody can still sniff your data EVEN if it is encrypted. (I can confirm that Twitter is not vulnerable to this the day I tested)
• This applies to other operating system apps such as Contacts, iCloud service, Notes, etc..