NIDAAN Intelligence Services (I) Pvt Ltd {It is popularly known as NIDAAN Intelligence World} is Jamshedpur, Jharkhand based establishment engaged in deliver...
Anya is live and ready to show you everything. Watch her strip, dance, and perform exclusive shows just for you. Interact in real-time and make your fantasies come true.
✓ Live Streaming✓ Interactive Chat✓ Private Shows✓ HD Quality✓ Free Actions
Free to watch • No registration required • HD streaming
When developing applications, the non-production environments do not always have valid certificates deployed. As a result, developers must override the applications validation of SSL/TLS certificates in order to complete their testing. The impact of not restoring this validation is that applications are deployed to production and accept all certificates as valid ones. A man in the middle (MITM) attack can be successfully performed with the application not displaying any message to the user indicating the connection is not valid.
Disabling the validation can be accomplished by implementing a class that overrides the X509TrustManager class’ checkServerTrusted method. Please see below the API documentation for the respective method.
The API states that the method must throw one of two exceptions in the case that the certificate or one of the certificates in the chain is invalid.
A sample implementation that accepts all SSL/TLS certificates as valid is shown below. Notice that both the checkClientTrusted and checkServerTrusted methods both are empty, meaning they do not perform any validations of the array of certificates that are passed to the method. The array of certificates is stored within the certs input parameter.
The pertinent question for us as assessors, is how can we validate this from based on the compiled Android application? The only way to assess the application’s implementation of SSL/TLS certificates is to reverse the application into smali code. A detailed discussion on how to convert an APK and extract the smali code will not be covered within this document as it has already been covered elsewhere. However, at a high-level, one can convert an APK to smali by using the APKTOOL. The command is: apktool d <application.apk> <output_dir>
Once the smali code has been prepared, use your favorite tool for searching of text within files to identify what smali class has the checkServerTrusted method implemented. In the example below, I used grep to identify the method within the respective file.
Based on the results returned, the checkServerTrusted method is part of the TrustManagerDecorator.smali file.
Reviewing this file we identify the method and see that it is actually performing some validation on the certificate. The TrustStrategy.isTrusted method is used to validate if the certificate chain can be trusted. If the method does not return a satisfactory result, it throws a CertificateException that the application can handle and process accordingly.
Documentation for isTrusted method
An example of a bad implementation of the checkServerTrusted method is shown below. Notice that the method does not have any code between the .method and .end method statements. When the
application would make a call to this method, nothing would occur; no validation would take place which would result in the method not throwing an exception.
