iOS apps affected by MiTM attack via networking library - check your apps

MagicDude4Eva

MagicDude4Eva

Banned
Joined
Apr 2, 2008
Messages
6,477
Reaction score
40
Location
Jo'burg
The advisory came out about a month ago, and since it has now become public, I will share this - http://www.naschenweng.info/2015/04/21/south-african-ios-apps-affected-security-flaw/

I suggest that you check your apps which use sensitive information via this link: http://searchlight.sourcedna.com/lookup and upgrade apps (or avoid using them until patched).

TL;DR: Only Uber seems to be affected and other apps have been patched. It does look like some local apps (Multichoice, Takealot etc) are using outdated libraries or have only recently updated. Interesting is that Uber for example downgraded to 2.5.0 instead of upgrading to the patched 2.5.2 version.
 
Last edited:
akescpt said:
what must like happen now?
Click to expand...

I doubt that most app developers are aware of that their apps have issues. Remember, that the chances of a MiTM are low (except if you use the apps on a public network). I would check via the above URL what apps you use and which have an issue and then inform the developers. Until the apps have been fixed, I would avoid using them on an untrusted network/Wifi hotspot etc.
 
MagicDude4Eva said:
I doubt that most app developers are aware of that their apps have issues. Remember, that the chances of a MiTM are low (except if you use the apps on a public network). I would check via the above URL what apps you use and which have an issue and then inform the developers. Until the apps have been fixed, I would avoid using them on an untrusted network/Wifi hotspot etc.
Click to expand...

so home network is fine?
 
Telegram LLC: Version: 2.9.4
What a shame... a month ago upgraded to 2.11. :)

Adobe: Reader, etc.. still bad!
Microsoft: OneDrive - important!
 
Last edited:
So development is all mostly about patching holes. I guess it's also a bit of a challenge to introduce new features because in the process you introduce new holes.
 
kianm said:
So development is all mostly about patching holes. I guess it's also a bit of a challenge to introduce new features because in the process you introduce new holes.
Click to expand...

Its an arms race. Those who get caught out are the ones who get complacent. iOS and Android are always going to be targets because of their footprint out there. The biggest risk is a developer/company who thinks their OS/Platform is immune to vulnerabilities and attack.

What people need to accept is that with enough effort, any platform can be hacked. If hackers had the resources of govt's they would be unstoppable. The ultimate protection is to not be connected to the internet at all. Of course this is extreme and not practical in obvious situations. But developers can follow some basics. The first and you would think the most obvious is keep your system updated with the latest security patches.

Just about every time you read about something like this, its a previous version which is vulnerable. And its staggering to see who doesn't keep the systems, particularly the security and network libraries, updated.
 
Security should be in the DNA when creating something and not just a feature sprinkled later.
 
You will be equally surprised how many apps have other security issues outside of SSL.

There are a number of local apps which assume that you"can not see the URL" or which have an implicit trust relationship with their backend systems just because a service is called via an app.

Throw in Charles Proxy and a bunch of other tools and you will not do your shopping or banking on a mobile device once you see what's going on.

Never mind the data being collected and sent to 3rd parties.
 
MagicDude4Eva said:
You will be equally surprised how many apps have other security issues outside of SSL.

There are a number of local apps which assume that you"can not see the URL" or which have an implicit trust relationship with their backend systems just because a service is called via an app.

Throw in Charles Proxy and a bunch of other tools and you will not do your shopping or banking on a mobile device once you see what's going on.

Never mind the data being collected and sent to 3rd parties.
Click to expand...

Thanks for the thread started, the heads up and information. I have to say it is the practice of passing on my data to 3rd parties that really grates me. It irritates me that use them in good faith and then they expose me and my preferences which were thought to be private to the highest bidder. Swines!
 
McT said:
Thanks for the thread started, the heads up and information. I have to say it is the practice of passing on my data to 3rd parties that really grates me. It irritates me that use them in good faith and then they expose me and my preferences which were thought to be private to the highest bidder. Swines!
Click to expand...

With POPI they are not allowed to do this without your consent, but most companies have horrible T&Cs which give them blanket permission to do anything with your data.

Almost all e-commerce sites do this and they will also share your purchasing history with 3rd parties in exchange for mailing lists or for profit. It is not uncommon for some to pay more than 20 bucks per contact.
 
Eish. Cybercrime versus carjacking
 
You must log in or register to reply here.
Back
Top
Sign up to the MyBroadband newsletter
X