HTTPS snooping flaw in third-party library affected 1,000 iOS apps with millions of users

The flaw in the AFNetworking library broke HTTPS certificate validation, enabling man-in-the-middle attacks

Apps used by millions of iPhone and iPad owners became vulnerable to snooping when a flaw was introduced into third-party code they used to establish HTTPS connections.

The flaw was located in an open-source library called AFNetworking that's used by hundreds of thousands of iOS and Mac OS X applications for communicating with Web services. The bug disabled the validation of digital certificates presented by servers when establishing secure HTTPS (HTTP over SSL/TLS) connections.

This means that attackers in a position to intercept encrypted traffic between affected applications and HTTPS servers could decrypt and modify the data by presenting the app with a fake certificate. This is known as a man-in-the-middle attack and can be launched over insecure wireless networks, by hacking into routers and through other methods.

The impact of the flaw for the iOS ecosystem was hard to gauge because the vulnerability only affected applications that used a particular version of AFNetworking -- 2.5.1 -- released on Feb. 9 and, of those, only the ones that relied on the library's SSL/TLS functionality.

The vulnerability was fixed in AFNetworking 2.5.2, released on March 26, so the flaw was active for a little over six weeks. How many iOS apps were updated to the vulnerable version in that time frame and how many of them used it for establishing HTTPS communications? A company called SourceDNA which tracks the use of third-party components in iOS and Android apps claims to have an answer.

There are over 100,000 iOS apps, out of the 1.4 million on the App Store, that use the AFNetworking library, the company said Monday in a blog post. Of those, around 20,000 had been updated or released during the time when the vulnerability existed.

SourceDNA created a signature for the vulnerable AFNetworking code and scanned those 20,000 apps to see how many of them had it. The scan showed that 55 percent used the older and safe 2.5.0 version of the library, another 40 percent were not using the library's vulnerable SSL/TLS API (application programming interface) at all, and 5 percent or around 1,000 apps were vulnerable.

One thousand vulnerable apps out of 100,000 might not sound too bad, but it actually is when taking into consideration that they included popular apps from high-profile vendors like Yahoo, Microsoft, Uber Technologies, Citrix and others.

"It amazes us that an open-source library that introduced a security flaw for only six weeks exposed millions of users to attack," SourceDNA said.

Some vendors, including Yahoo, have already patched their apps, but others remain vulnerable, so SourceDNA created a website that allows users to check if their installed apps are vulnerable.

Join the Good Gear Guide newsletter!

Error: Please check your email address.

Tags patchesCitrixonline safetyMicrosoftsecuritymobile securityencryptionExploits / vulnerabilitiesSourceDNAUber TechnologiesYahoo

Our Back to Business guide highlights the best products for you to boost your productivity at home, on the road, at the office, or in the classroom.

Keep up with the latest tech news, reviews and previews by subscribing to the Good Gear Guide newsletter.

Lucian Constantin

IDG News Service
Show Comments

Cool Tech

Crucial Ballistix Elite 32GB Kit (4 x 8GB) DDR4-3000 UDIMM

Learn more >

Gadgets & Things

Lexar® Professional 1000x microSDHC™/microSDXC™ UHS-II cards

Learn more >

Family Friendly

Lexar® JumpDrive® S57 USB 3.0 flash drive 

Learn more >

Stocking Stuffer

Plox Star Wars Death Star Levitating Bluetooth Speaker

Learn more >

Christmas Gift Guide

Click for more ›

Most Popular Reviews

Latest News Articles

Resources

GGG Evaluation Team

Kathy Cassidy

STYLISTIC Q702

First impression on unpacking the Q702 test unit was the solid feel and clean, minimalist styling.

Anthony Grifoni

STYLISTIC Q572

For work use, Microsoft Word and Excel programs pre-installed on the device are adequate for preparing short documents.

Steph Mundell

LIFEBOOK UH574

The Fujitsu LifeBook UH574 allowed for great mobility without being obnoxiously heavy or clunky. Its twelve hours of battery life did not disappoint.

Andrew Mitsi

STYLISTIC Q702

The screen was particularly good. It is bright and visible from most angles, however heat is an issue, particularly around the Windows button on the front, and on the back where the battery housing is located.

Simon Harriott

STYLISTIC Q702

My first impression after unboxing the Q702 is that it is a nice looking unit. Styling is somewhat minimalist but very effective. The tablet part, once detached, has a nice weight, and no buttons or switches are located in awkward or intrusive positions.

Featured Content

Latest Jobs

Don’t have an account? Sign up here

Don't have an account? Sign up now

Forgot password?