IMDEA Networks Institute Publications Repository

Studying TLS Usage in Android Apps

Razaghpanah, Abbas and Niaki, Arian Akhavan and Vallina-Rodriguez, Narseo and Sundaresan, Srikanth and Amann, Johanna and Gill, Phillipa (2017) Studying TLS Usage in Android Apps. In: The 13th International Conference on emerging Networking EXperiments and Technologies (ACM CoNEXT 2017), 12-15 December 2017, Seoul, South Korea.

[img] PDF (Studying TLS Usage in Android Apps) - Published Version
Download (527Kb)

Abstract

Transport Layer Security (TLS), has become the {\em de-facto} standard for secure Internet communication. When used correctly, it provides secure data transfer, but used incorrectly, it can leave users vulnerable to attacks while giving them a false sense of security. Numerous efforts have studied the adoption of TLS (and its predecessor, SSL) and its use in the desktop ecosystem, attacks, and vulnerabilities in both desktop clients and servers. However, there is a dearth of knowledge of how TLS is used in mobile platforms. In this paper we use data collected by Lumen, a mobile measurement platform, to analyze how Android apps use TLS in the wild. We analyze and fingerprint handshake messages to characterize the TLS APIs and libraries that apps use, and also evaluate weaknesses. We see that about 84% of apps use default OS APIs for TLS. Many apps use third party libraries; in some cases they are forced to do so because of restricted Android capabilities. Our analysis shows that both approaches have limitations, and that improving TLS security in mobile is not straightforward. Apps that use their own TLS configurations have vulnerabilities due to developer inexperience, but apps that use OS defaults are vulnerable to certain attacks if the OS is out of date, even if the apps themselves are up to date. We also study certificate verification and third-party libraries used in Android apps, and see low prevalence of security measures such as certificate pinning, even among high-risk apps such as those providing financial services, though we did observe major tracking and advertisement services deploying certificate pinning. We have made our dataset, which is the first of its kind, available to download to the public.

Item Type: Conference or Workshop Papers (Paper)
Uncontrolled Keywords: Security Protocols, Android, Mobile, Network Measurements, Transport Layer Security, Secure Sockets Layer, SSL, TLS, Transport Layer Protocols, Mobile Security.
Subjects: UNSPECIFIED
Divisions: UNSPECIFIED
Depositing User: Narseo Vallina
Date Deposited: 05 Oct 2017 07:28
Last Modified: 08 Nov 2017 15:39
URI: http://eprints.networks.imdea.org/id/eprint/1690

Actions (login required)

View Item View Item