iOS Apps Vulnerable to HTTPS Data Decryption

A Bug in an Older Version of a Widely Used Networking Library for iOS and OS X, Present in Products from Prominent Developers, Can be Exploited to Decrypt the Secure Traffic from an iOS App, Allowing an Attacker Access to Sensitive Data like Credentials and Banking Info. Build 2.5.1 of Open Source AFNetworking is Affected by a Security Vulnerability that Disables SSL (Secure Sockets Layer) Certificate Validation, Permitting Someone in a Position to Intercept the Connection (Man-in-the-Middle Attack) to Read the Encrypted Information in Plain Text. The Security Flaw was Patched in Late March but, Not All Developers Integrated the Updated Code into their Apps, Leaving their Users Exposed, especially those still Employing Outdated Versions. In a Research from SourceDNA on Monday, the Analytics Service Created Fingerprints for Tracking Down the Free Apps that Contain AFNetworking 2.5.1 and Discovered that about 1,000 Products Didn't Move to the Succeeding, Safer Version of the Library.


The Faulty Release of AFNetworking is included in Software from Major Developers, such as Yahoo (Yahoo Finance 2.3.2) and Microsoft (OneDrive 5.1). Their Apps, however, Have been Updated to New Versions that Rely on a Secure Variant of the Networking Library so, Users should Simply Install the Latest Revision to be on the Safe Side. On the Other Hand, there are Other Developers Who Haven't Made the Switch and Whose Users May Become Victims. Two of them are Alibaba.com (Build 3.3.2 and 3.3.3) and Citrix (OpenVoice Audio Conferencing 1.4.0 and 1.5.1). To Help Both Users and Developers Identify the Hazardous Products, SourceDNA Released a Service that Checks if the Apps from a Developer are Vulnerable. According to SourceDNA, the Number of Users Impacted Amounts to Millions. Developers Have Started to Address the Risk and Released Updates for their Products so, Clients should be Able to Install the New, Risk-Free Revisions.




Info Sources:

https://github.com/AFNetworking/AFNetworking

http://blog.mindedsecurity.com/2015/03/ssl-mitm-attack-in-afnetworking-251-do.html?m=1

http://sourcedna.com/blog/20150420/afnetworking-vulnerability.html

http://searchlight.sourcedna.com/lookup