Image from Iconfinder
A bunch of iOS apps were found to be “vulnerable to silent interception of (normally) TLS-protected data while in use”, according to a report.
Writing in Medium, CEO of Sudo Security Group Will Strafach said it was while doing the development of their Web-based mobile app analysis service verify.ly, that they had decided it was essential to have a clear understanding of the most common security issues which plagued mobile applications today.
Automatically scanning the binary code of applications within the Apple App Store en-masse allowed us to get a vast amount of information about these security issues.Our system flagged hundreds of applications as having a high likelihood of vulnerability to data interception, but at this time I will be posting details of the connections and data which I was able to fully confirm as vulnerable using a live iPhone running iOS 10 and a “malicious” proxy to insert an invalid TLS certificate into the connection for testing.
- Highlights
During the testing process, I was able to confirm 76 popular iOS applications allow a silent man-in-the-middle attack to be performed on connections which should be protected by TLS (HTTPS), allowing interception and/or manipulation of data in motion. - For 33 of the iOS applications, this vulnerability was deemed to be low risk (All data confirmed vulnerable to intercept is only partially sensitive analytics data about the device, partially sensitive personal data such as e-mail address, and/or login credentials which would only be entered on a non-hostile network).
- For 24 of the iOS applications, this vulnerability was deemed to be medium risk (Confirmed ability to intercept service login credentials and/or session authentication tokens for logged in users).
- For 19 of the iOS applications, this vulnerability was deemed to be high risk (Confirmed ability to intercept financial or medical service login credentials and/or session authentication tokens for logged in users).
- The App Transport Security feature of iOS does not and cannot help block this vulnerability from working.
To read the rest of Will’s post, click here.
•Share This•