A recent research has revealed something disturbing. It says that a majority of the apps that is popular on the Android platform is vulnerable to hackers and cyber attacks. The Google Android has been a platform that has been immensely successful and popular in smart phones and has enabled Google to have a stranglehold market share. However, due to its Open Source framework, the potential for security abuse and hacking increases dramatically. Ironically, it is this Open Source architecture that has also enthuses developers to come up with a plethora of apps that have made Android what it is today.

Apps Vulnerable To MITM Attacks

The study analyzed more than 1000 free apps that are downloaded for free from the Google Play Store. Many of them are very popular among smart phone users and were found to be susceptible to the MITM or Man-In-The-Middle attacks. About 68% of the apps were found to be vulnerable to any one of the three SSL weaknesses. It means that cyber criminals can easily lift data that is security sensitive from 68% of the apps downloaded by users and that is indeed a high number.

The MITM attacks take place when the hacker is able to access data that is being exchanged by the user device and the remote server. Once he intercepts this data, he can lift it and gain knowledge of the passwords or usernames including emails, photos and videos. Criminals can also then inject malicious codes and files into these apps that can then impact the device.

Experts Track Vulnerabilities To Configurations

The team of security experts doing the study tracked the reasons for this vulnerability and said it was the configurations inside of the advertising libraries that caused them. The apps developers use these libraries to run advertisements without creating the libraries all over again and just use the ones created by the creator of the apps.

Though the HTTPS protocol is a tough nut to crack, the random and incorrect usage of these SSL libraries compromise the security and enable MITM attacks to take place. The main SSL vulnerabilities are the absence of checking of certificates by trust managers; hostname verifiers not doing the job and SSL errors within Webkit that are ignored. At least 73% checking of the certificates did not take place with over 7% making use of their hostname verifiers that did not do a perfect job of verifying hostnames in 614 apps. The  285 apps that used Webkit witnessed neglect of SSL errors.

Developers Have Been Notified

Post this discovery, the respective developers have been informed by the security experts to address the problem in future versions and they have agreed to do so. The main issue continues to be the laxity of trust managers not checking server certificates and that leads to data exposure during server exchange. This number is as high as 40% and if this can be sorted out, security of Android apps would improve significantly.