15

I checked out the app Packet Capture.

This app is able to decrypt my app APIs (SSL Enabled) data by mounting a MITM attack using the Android VPN service. This does not even require root.

How can I prevent it? We want to transmit secure data through our servers to Android devices.

Improve this question
4
  • SSL is supposed to be protected against MITM via certificates. That link doesn't explain how it gets around that. I'm rather suspicious of this app. – S.L. Barth Apr 12 '15 at 9:34
  • 3
    @S.L.Barth If you want to intercept SSL traffic using that app, it asks you to install its own CA certificate to the device. Then it MITMs all the data for analysis. Of course, if you install someone's CA certificate on your device, you can potentially be MITMed by that person. – vurp0 Apr 12 '15 at 10:46
  • You could be able to access the Certificate details of the current SSL-Connection. Then you can validate which CA signed the public certificate which is being used - and if this is not the CA you are usually using display a warning to the user. – Falco Apr 13 '15 at 9:25
  • Are you really interested in security or do you want some kind of DRM? – CodesInChaos Apr 13 '15 at 14:08
23

That app (and all MITM proxy apps such as SandroProxy and mitmproxy) work by installing their own trusted CA certificate on the device. That allows them to sign their own certificates which the device will accept.

You have to manually install their certificate to the user key-store using a dialogue such as this:

enter image description here

After which it displays warnings such as this:

enter image description here

enter image description here

It's unlikely (albeit not completely impossible) that a user would do this unintentionally, so overall it's a reasonably low threat.

Having said that, if you want to protect your App even if someone has installed a malicious CA certificate then you should implement certificate pinning.

If the device is rooted then it is conceivable that an attacker could install a malicious certificate, conceal it, and modify your Apps to compromise validation and prevent pinning. However, if something rogue has root access then essentially your entire device is compromised any way.

Improve this answer
1
  • 1
    Hello, sorry but this is not true "It's unlikely (albeit not completely impossible) that a user would do this unintentionally, so overall it's a reasonably low threat.". There is & was attacks which uses MDM integration, this integration capabilities will end up with managing everything on that phone. Users are not able to understand what is safe or not... For example you can see thehackernews.com/2018/07/mdm-software-hack-iphone.html – alnbhclyn May 29 '19 at 21:46
4

To give the good answer from thexacre a broader touch: If the application itself does the certificate checking correctly (not all do, see http://www.kb.cert.org/vuls/id/582497) then an MITM attack is only possible if the attacker is somehow trusted by the owner of the device. In case of an owner which is curious what the application does the attacker is the owner itself, but it might also be an external attacker which compromised the device (i.e. an unwanted trust relationship). Only with this trust it is possible to get the additional trusted CA installed which is needed to intercept the SSL connection.

And while certificate pinning or public key pinning might be used to get around the problem of SSL interception outside the application, a knowledgeable attacker might still be able to hook into the application and extract the unencrypted data directly from inside the application. In general it is not possible to prevent these kind of attacks as long as the software is running in an environment which is sufficiently controlled by the attacker. You might only try to make it harder with anti-debugging techniques which are often used by DRM solutions and malware.

Improve this answer
4
  • I agree that all of your points are excellent additions to the question, but did you have a specific vector in mind with regard to "hook into the application and extract the unencrypted data directly from inside the application"? Some specific examples come to mind such abusing Intents/IPC if the application is either leaking information or not sanitizing input via these, but in general I think most application data (such as SQLite databases) is protected by being owned by different file system users, which is a fairly secure mechanism unless the device has been rooted. – thexacre Apr 12 '15 at 11:27
  • No, I consider that the attacker (which might be the owner) has root access to the device and then can use techniques like described in Bypassing SSL Pinning on Android via Reverse Engineering. Often developers think that manipulations (like for a game) are impossible if they simply use TLS. – Steffen Ullrich Apr 12 '15 at 11:31
  • I'm with you now, I edited my answer to avoid giving the impression that certificate validation couldn't be compromised by an attacker with root. – thexacre Apr 12 '15 at 11:37
  • 1
    DRM and malware No need to repeat yourself... – Mason Wheeler Apr 13 '15 at 12:36

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.