I was at their presentation earlier today. Maybe not a big thing, but I liked their conclusion. they demonstrated a mitm-proxy that gave 301s so that ignorant n

I was at their presentation earlier today. Maybe not a big thing, but I liked their conclusion. they demonstrated a mitm-proxy that gave 301s so that ignorant native apps loaded and cached external trusted resources. They also mentioned using malicious iphone profiles with new certificates or configured proxy. Demoed also using faked captive network, maybe also with pineapple/wifigate Thy also claimed many apps had this vulnerability. They also said it was easy to fix. Think about caching in native clients, and ignore 301s in native apps. They didn't mention 302s More info here http://www.skycure.com/blog/http-request-hijacking/ http://www.skycure.com/blog/http-request-hijacking/