Studying TLS Usage in Android Apps
| Autor: | Johanna Amann, Narseo Vallina-Rodriguez, Srikanth Sundaresan, Abbas Razaghpanah, Phillipa Gill, Arian Akhavan Niaki |
|---|---|
| Rok vydání: | 2017 |
| Předmět: |
Transport Layer Protocols
Internet communication Network Measurements Handshake Computer science 02 engineering and technology Computer security computer.software_genre Mobile World Wide Web Robustness (computer science) Android Server TLS 0202 electrical engineering electronic engineering information engineering Mobile Security Android (operating system) Financial services Transport Layer Security business.industry ComputerSystemsOrganization_COMPUTER-COMMUNICATIONNETWORKS Mobile apps SSL 020206 networking & telecommunications Cryptographic protocol Certificate Security Protocols The Internet 020201 artificial intelligence & image processing Secure Sockets Layer business computer Strengths and weaknesses |
| Zdroj: | CoNEXT IMDEA Networks Institute Digital Repository instname ANRW IMDEA Networks Institute |
| DOI: | 10.1145/3143361.3143400 |
| Popis: | Transport Layer Security (TLS), has become the {\em de-facto} standard for secure Internet communication. When used correctly, it provides secure data transfer, but used incorrectly, it can leave users vulnerable to attacks while giving them a false sense of security. Numerous efforts have studied the adoption of TLS (and its predecessor, SSL) and its use in the desktop ecosystem, attacks, and vulnerabilities in both desktop clients and servers. However, there is a dearth of knowledge of how TLS is used in mobile platforms. In this paper we use data collected by Lumen, a mobile measurement platform, to analyze how Android apps use TLS in the wild. We analyze and fingerprint handshake messages to characterize the TLS APIs and libraries that apps use, and also evaluate weaknesses. We see that about 84% of apps use default OS APIs for TLS. Many apps use third party libraries; in some cases they are forced to do so because of restricted Android capabilities. Our analysis shows that both approaches have limitations, and that improving TLS security in mobile is not straightforward. Apps that use their own TLS configurations have vulnerabilities due to developer inexperience, but apps that use OS defaults are vulnerable to certain attacks if the OS is out of date, even if the apps themselves are up to date. We also study certificate verification and third-party libraries used in Android apps, and see low prevalence of security measures such as certificate pinning, even among high-risk apps such as those providing financial services, though we did observe major tracking and advertisement services deploying certificate pinning. We have made our dataset, which is the first of its kind, available to download to the public. TRUE pub |
| Databáze: | OpenAIRE |
| Externí odkaz: |
|