Menu
HTTPS snooping flaw in third-party library affected 1,000 iOS apps with millions of users

HTTPS snooping flaw in third-party library affected 1,000 iOS apps with millions of users

The flaw in the AFNetworking library broke HTTPS certificate validation, enabling man-in-the-middle attacks

Apps used by millions of iPhone and iPad owners became vulnerable to snooping when a flaw was introduced into third-party code they used to establish HTTPS connections.

The flaw was located in an open-source library called AFNetworking that's used by hundreds of thousands of iOS and Mac OS X applications for communicating with Web services. The bug disabled the validation of digital certificates presented by servers when establishing secure HTTPS (HTTP over SSL/TLS) connections.

This means that attackers in a position to intercept encrypted traffic between affected applications and HTTPS servers could decrypt and modify the data by presenting the app with a fake certificate. This is known as a man-in-the-middle attack and can be launched over insecure wireless networks, by hacking into routers and through other methods.

The impact of the flaw for the iOS ecosystem was hard to gauge because the vulnerability only affected applications that used a particular version of AFNetworking -- 2.5.1 -- released on Feb. 9 and, of those, only the ones that relied on the library's SSL/TLS functionality.

The vulnerability was fixed in AFNetworking 2.5.2, released on March 26, so the flaw was active for a little over six weeks. How many iOS apps were updated to the vulnerable version in that time frame and how many of them used it for establishing HTTPS communications? A company called SourceDNA which tracks the use of third-party components in iOS and Android apps claims to have an answer.

There are over 100,000 iOS apps, out of the 1.4 million on the App Store, that use the AFNetworking library, the company said Monday in a blog post. Of those, around 20,000 had been updated or released during the time when the vulnerability existed.

SourceDNA created a signature for the vulnerable AFNetworking code and scanned those 20,000 apps to see how many of them had it. The scan showed that 55 percent used the older and safe 2.5.0 version of the library, another 40 percent were not using the library's vulnerable SSL/TLS API (application programming interface) at all, and 5 percent or around 1,000 apps were vulnerable.

One thousand vulnerable apps out of 100,000 might not sound too bad, but it actually is when taking into consideration that they included popular apps from high-profile vendors like Yahoo, Microsoft, Uber Technologies, Citrix and others.

"It amazes us that an open-source library that introduced a security flaw for only six weeks exposed millions of users to attack," SourceDNA said.

Some vendors, including Yahoo, have already patched their apps, but others remain vulnerable, so SourceDNA created a website that allows users to check if their installed apps are vulnerable.

Follow Us

Join the New Zealand Reseller News newsletter!

Error: Please check your email address.

Tags patchesCitrixonline safetyMicrosoftsecuritymobile securityencryptionExploits / vulnerabilitiesSourceDNAUber TechnologiesYahoo

Slideshows

Top 50 defining moments of the New Zealand channel in 2016

Top 50 defining moments of the New Zealand channel in 2016

Reseller News looks back on a tumultuous 12 months for the New Zealand channel, assessing the fallout from a year of sizeable industry change. Whether it be local or global mergers and acquisitions, distribution deals or job changes, the channel that started the year differs somewhat to the one set to finish it - Reseller News assesses the key moments that made 2016.​

Top 50 defining moments of the New Zealand channel in 2016
​Hewlett Packard Enterprise honours high achieving NZ channel

​Hewlett Packard Enterprise honours high achieving NZ channel

Hewlett Packard Enterprise honoured its top performing Kiwi partners at the second running of its HPE Partner Awards in New Zealand, held at a glitzy ceremony in Auckland. Recognising excellence across eight categories - from distributors to resellers - the tech giant celebrated its first year as a standalone company, following its official split from HP in 2015.

​Hewlett Packard Enterprise honours high achieving NZ channel
Nutanix treats channel partners to Christmas cruise

Nutanix treats channel partners to Christmas cruise

Nutanix recently took to the seas for a Christmas Cruise around Sydney Harbour with its Australia and New Zealand staff, customers and partners to celebrate a stellar year for the vendor. With the sun out, they were all smiles and mingled over drinks and food.

Nutanix treats channel partners to Christmas cruise
Show Comments