About 1,500 iPhone and iPad apps contain an HTTPS-crippling vulnerability that makes it easy for attackers to intercept encrypted passwords, bank-account numbers, and other highly sensitive information, according to research released Monday.
An estimated two million people have installed the vulnerable apps, which include the Citrix OpenVoice Audio Conferencing, the Alibaba.com mobile app, Movies by Flixster with Rotten Tomatoes, KYBankAgent 3.0, and Revo Restaurant Point of Sale, according to analytics service SourceDNA. The weakness is the result of a bug in an older version of the AFNetworking, an open-source code library that allows developers to drop networking capabilities into their apps. Although AFNetworking maintainers fixed the flaw three weeks ago with the release of version 2.5.2, at least 1,500 iOS apps remain vulnerable because they still use version 2.5.1. That version became available in January and introduced the HTTPS-crippling flaw.
"The issue occurs even when the mobile application requests the library to apply checks for server validation in SSL certificates," researchers Simone Bovi and Mauro Gentile wrote in a blog post published in late March. They went on to say that they analyzed one app running AFNetworking 2.5.1 and found alarming results. "We tested the app on a real device and, unexpectedly, we found that all the SSL traffic could be regularly intercepted through a proxy like Burp without any intervention!" (Emphasis is theirs.)
According to research published Monday by SourceDNA, about 1,500 iOS apps remain vulnerable to man-in-the-middle attacks that can decrypt HTTPS-encrypted data. To exploit the bug, attackers on a coffee shop Wi-Fi network or in another position to monitor the connection of a vulnerable device need only present it with a fraudulent secure sockets layer certificate. Under normal conditions the credential would immediately be detected as a counterfeit, and the connection would be dropped. But because of a logic error in the code of version 2.5.1, the validation check is never carried out, so fraudulent certificates are fully trusted.
SourceDNA identified vulnerable apps by scanning all free titles and the top 5,000 for-fee titles available for download in Apple's App Store and analyzing the binary code in each one. (In all, about 1 million of the 1.4 million titles in the App Store were analyzed.) This made it possible for researchers to identify apps based on their behavior and the tools and libraries they're made with. The 1,500 vulnerable apps are those that use AFNetworking version 2.5.1, implement HTTPS, and don't implement a measure known as certificate pinning, which ensures that an app uses only a specific certificate for HTTPS authentication and encryption. By default, certificate pinning is turned off in AFNetworking. The 1,500 apps identified don't include those that were fixed after SourceDNA privately reported the vulnerability to developers. App developers who fixed the bug include companies such as Yahoo, Microsoft, and Uber.
For the past four weeks, SourceDNA has kept the list of vulnerable apps private to prevent real-world attacks. The company has now unveiled a search tool that lets end users check if specific apps they use are vulnerable. The tool will be updated regularly to remove apps that are fixed and add apps that become vulnerable. SourceDNA also offers a service that provides a comprehensive inventory of commercial and open-source code used in specific apps, along with an alert service that will notify users if vulnerabilities are found in any of them.
iOS users should spend a few minutes to check if any of the apps they use are among those found to be vulnerable. Readers are invited to report their findings in the comments section of this post.
Listing image by Jorge Quinteros. Article updated to correct details in the fifth paragraph about scanning methodology. Only the top 5,000 for-fee apps were tested.
Listing image by Jorge Quinteros
reader comments
82