SSL Validation Checking vs. Go(ing) to Fail
summary
Built a Python tool around mitmproxy called SVF SSL-Validation-Fuzzer that intercepts handshakes, mutates server certificates and feeds them back to clients to see if validation is enforced. Applied it to 90 mobile banking apps across iOS, Android and Windows Phone; about 20% fail validation (some accept untrusted or random certs), several are vulnerable to SSL stripping, and many server endpoints still negotiate SSLv3/CBC, showing real exploitable gaps.
AI-written summary · about
chapters (10)
- 0:00Start
- 0:31Presentation Outline
- 2:02Starting point: Apple's security related update iOS 7.0.6
- 6:04What did it mean?
- 6:47Our thoughts at this point
- 7:37This lead to our main research questions
- 16:25Demo-Time!
- 18:19Results 1/2: The bad news
- 21:43Results 2/2: The good news
- 22:46Summary & Take Aways
related talks
46mSelf-Signed, Why Not! Exploiting Insecure Certificate Validation In iOS And macOS
48mChain of Fools: An Exploration of Certificate Chain Validation Mishaps
45mFast Forwarding Mobile Security With The OWASP Mobile Security Testing Guide
52mWhere, how, and why is SSL traffic on mobile getting intercepted?
48mMobile Security Attacks: A Glimpse from the Trenches
57m(In)Security of Mobile Banking
44mHow the latest MASVS & MSTG Specs Make the Best Mobile Pen Testing Cocktails
13mX.509DoS: Exploiting and Detecting Denial-of-Service Vulnerabilities in