http://jvn.jp/en/jp/JVN39218538/Android apps that use SSL/TLS protocols for secure communication should properly verify server certificates. The basic verification includes:
...
In the example above, checkClientTrusted()and checkServerTrusted() are overriden to make a blank implementation so that SSLSocketFactory does not verify the SSL certificate. The MySSLSocketFactory class is used to create an instance of HttpClient in another part of the application.
Proof of Concept
Typically, an application stores files in the directory as follows:
| Code Block |
|---|
/sdcard/Android/data/com.company.app/files/save/appdata/save_appdata
|
Compliant Solution (Save a File on Internal Storage)
The following code uses the openFileOutput() method to create "myfile" in an application data directory with permission set to MODE_PRIVATE so that other apps cannot access the file:
sAllowAllSSL, which is a static member of the DefineRelease class, is initialized to true in its static constructor. This will enable the use of SSLSocketFactory.ALLOW_ALL_HOSTNAME_VERIFIER. As a result, host name verification that should take place when establishing an SSL connection is disabled and will lead to the same situation as all the certificate is trusted.
Compliant Solution
The compliant solution may vary, depending on the actual implementation. For examples of secure implementation such as using a self-signed server certificate, please refer to "Android Application Secure Design/Secure Coding Guidebook", 5.4 Communicate by HTTPS.
Risk Assessment
Not properly verifying the server certificate on SSL/TLS may allow apps to connect to an imposter site, while fooling the user into thinking that the user is connected to an intended site. One example of associated risks is that this could expose a user's sensitive data
| Code Block | ||
|---|---|---|
| ||
private String filename = "myfile"
private String string = "sensitive data such as credit card number"
FileOutputStream fos = null;
try {
fos = openFileOutput(filename, Context.MODE_PRIVATE);
fos.write(string.getBytes());
fos.close();
} catch (FileNotFoundException e) {
// handle FileNotFoundException
} catch (IOException e) {
// handle IOException
} finally {
if (fos != null) {
try {
fos.close();
} catch (IOException e) {
}
}
}
|
Risk Assessment
Storing sensitive information on external storage can leak sensitive information to malicious apps.
Rule | Severity | Likelihood | Remediation Cost | Priority | Level |
|---|---|---|---|---|---|
DRD00DRD19-J | high | probable | medium | P12 | L1 |
Automated Detection
It is possible to automatically detect whether an application writes to external storage. It uses one of the three Android SDK packages named for establishing network connections, and to check if any of the methods from those classes are overriden by the application. It is not feasible to automatically determine whether such output could be stored internallythe intent of the app or the environment the apps are used in.
Related Vulnerabilities
- JVN#39218538 Pizza Hut Japan Official Order App for Android has a problem whereby it fails to verify SSL server certificates.
- JVN#75084836 Yome Collection for Android has a problem with management of IMEI.
- JVN#68156832 Yafuoku! contains an issue where it fails to verify SSL server certificates.
- JVN#92038939 mixi for Android information management vulnerability
- JVN#05102851 Yome Collection for Android issue in management of IMEI
Related Guidelines
Android Secure Coding Guidebook by JSSEC | 45.6 Secure File Handling |
Bibliography
4 Communicate by HTTPS |
Bibliography
| Fahl 2012 | Why Eve and Mallory Love Android: An Analysis of Android SSL (In)Security |
| [Android API 2013] | Class Environment |
| [JSSEC 2013] | 4.6 Secure File Handling |