4 ms·

> That's hardly the same thing - you have to actually > run/install something on the Android device itself. I was scratching my head trying to figure out w

by kanzure 14y ago

> That's hardly the same thing - you have to actually > run/install something on the Android device itself. I was scratching my head trying to figure out where the impedance mismatch was between our two comments... first, you're obviously talking about man-in-the-middle attacks on untouched devices in the wild. Second, your original statement that I was quoting was about intercepting Google apps that contact *.google.com, which I was pointing out that you can do anyway in a controlled environment. I thought you were surprised about the latter in the context of app security, otherwise why would you mention those apps specifically instead of the entirety of all traffic you can intercept etc.

RyanZAG 14y ago
The general issue is that if your communication between your device and server is going over HTTP, then anybody can sniff it and modify it. This is pretty well known, and the 'solution' is to use SSL. Unfortunately with these open .google.com certificates in the wild, any android device that would have been securely connecting with SSL to a google server is now wide open to MITM as if it wasn't using SSL at all. I mentioned .google.com in particular since that's the certs floating in the wild, but obviously certs could be made for any site. *.google.com is also of particular issue as your Android device will hold a secure channel open for commands from Google Play. Anybody who can pretend to be Google Play can add/remove applications from your device as they wish, and Google Play itself runs with elevated privileges and can be used to keylog passwords, intercept credit cards, etc. This is bad stuff, man. At this very minute, someone may have installed a fake cert at your ISP, and your Android device may in fact be compromised without you having any idea. Obviously a completely different issue to hijacking traffic in a controlled environment!

by kanzure 14y ago

RyanZAG 14y ago

The general issue is that if your communication between your device and server is going over HTTP, then anybody can sniff it and modify it. This is pretty well known, and the 'solution' is to use SSL. Unfortunately with these open .google.com certificates in the wild, any android device that would have been securely connecting with SSL to a google server is now wide open to MITM as if it wasn't using SSL at all. I mentioned .google.com in particular since that's the certs floating in the wild, but obviously certs could be made for any site. *.google.com is also of particular issue as your Android device will hold a secure channel open for commands from Google Play. Anybody who can pretend to be Google Play can add/remove applications from your device as they wish, and Google Play itself runs with elevated privileges and can be used to keylog passwords, intercept credit cards, etc. This is bad stuff, man. At this very minute, someone may have installed a fake cert at your ISP, and your Android device may in fact be compromised without you having any idea. Obviously a completely different issue to hijacking traffic in a controlled environment!