Detection of SSL/TLS Implementation Errors in Android Applications
Security Socket Layer (SSL) / Transport Layer Security (TLS) protocols are utilized to secure network communication (e.g., transmitting user data). Failing to properly implement SSL/TLS configuration during the app development results in security risks. The weak implementations include trusting a...
| Main Authors: | , |
|---|---|
| Format: | Article |
| Language: | English |
| Published: |
Gazi University
2021-06-01
|
| Series: | Gazi Üniversitesi Fen Bilimleri Dergisi |
| Subjects: | |
| Online Access: | https://dergipark.org.tr/tr/download/article-file/1569092 |
| _version_ | 1828016219384446976 |
|---|---|
| author | Kaya Emre CİBALIK Cemal KOÇAK |
| author_facet | Kaya Emre CİBALIK Cemal KOÇAK |
| author_sort | Kaya Emre CİBALIK |
| collection | DOAJ |
| description | Security Socket Layer (SSL) / Transport Layer Security (TLS) protocols are utilized to secure
network communication (e.g., transmitting user data). Failing to properly implement SSL/TLS
configuration during the app development results in security risks. The weak implementations
include trusting all host names, trusting all certificates, ignoring certificate verification errors,
even lack of SSL public key pinning usage. These unsecured implementations may cause ManIn-The-Middle (MITM) attacks. The major aim of this research is to detect configuration errors of SSL/TLS implementation in Android apps. It consists of the common use of existing open source tools in the static analysis phase and the combination of manual method in the dynamic analysis phase. During the static analysis phase, dynamic analysis of the findings obtained by scanning four types of vulnerabilities is used to verify the abuse status of SSL/TLS by testing. The dynamic analysis is essential for eliminating false positives generated at the static analysis stage. We analyze 109 apps from Google Play Store and the experimental results show that 45 (41.28%) apps contain potential security errors in the application of SSL/TLS. We verify that 19 (17.43%) out of 109 apps are vulnerable to MITM attacks. |
| first_indexed | 2024-04-10T10:30:18Z |
| format | Article |
| id | doaj.art-bf653ae5134849e6bbf9be17467807f1 |
| institution | Directory Open Access Journal |
| issn | 2147-9526 |
| language | English |
| last_indexed | 2024-04-10T10:30:18Z |
| publishDate | 2021-06-01 |
| publisher | Gazi University |
| record_format | Article |
| series | Gazi Üniversitesi Fen Bilimleri Dergisi |
| spelling | doaj.art-bf653ae5134849e6bbf9be17467807f12023-02-15T16:21:10ZengGazi UniversityGazi Üniversitesi Fen Bilimleri Dergisi2147-95262021-06-019221121910.29109/gujsc.878053Detection of SSL/TLS Implementation Errors in Android ApplicationsKaya Emre CİBALIKhttps://orcid.org/0000-0002-9449-8465Cemal KOÇAKhttps://orcid.org/0000-0002-8902-0934Security Socket Layer (SSL) / Transport Layer Security (TLS) protocols are utilized to secure network communication (e.g., transmitting user data). Failing to properly implement SSL/TLS configuration during the app development results in security risks. The weak implementations include trusting all host names, trusting all certificates, ignoring certificate verification errors, even lack of SSL public key pinning usage. These unsecured implementations may cause ManIn-The-Middle (MITM) attacks. The major aim of this research is to detect configuration errors of SSL/TLS implementation in Android apps. It consists of the common use of existing open source tools in the static analysis phase and the combination of manual method in the dynamic analysis phase. During the static analysis phase, dynamic analysis of the findings obtained by scanning four types of vulnerabilities is used to verify the abuse status of SSL/TLS by testing. The dynamic analysis is essential for eliminating false positives generated at the static analysis stage. We analyze 109 apps from Google Play Store and the experimental results show that 45 (41.28%) apps contain potential security errors in the application of SSL/TLS. We verify that 19 (17.43%) out of 109 apps are vulnerable to MITM attacks.https://dergipark.org.tr/tr/download/article-file/1569092androidapplication securityssl/tlsmobile security |
| spellingShingle | Kaya Emre CİBALIK Cemal KOÇAK Detection of SSL/TLS Implementation Errors in Android Applications Gazi Üniversitesi Fen Bilimleri Dergisi android application security ssl/tls mobile security |
| title | Detection of SSL/TLS Implementation Errors in Android Applications |
| title_full | Detection of SSL/TLS Implementation Errors in Android Applications |
| title_fullStr | Detection of SSL/TLS Implementation Errors in Android Applications |
| title_full_unstemmed | Detection of SSL/TLS Implementation Errors in Android Applications |
| title_short | Detection of SSL/TLS Implementation Errors in Android Applications |
| title_sort | detection of ssl tls implementation errors in android applications |
| topic | android application security ssl/tls mobile security |
| url | https://dergipark.org.tr/tr/download/article-file/1569092 |
| work_keys_str_mv | AT kayaemrecibalik detectionofssltlsimplementationerrorsinandroidapplications AT cemalkocak detectionofssltlsimplementationerrorsinandroidapplications |