International Journal of Computer Network and Information Security (IJCNIS)
IJCNIS Vol. 10, No. 7, 8 Jul. 2018
Cover page and Table of Contents: PDF (size: 582KB)
Assessing Vulnerability of Mobile Messaging Apps to Man-in-the-Middle (MitM) Attack
Full Text (PDF, 582KB), PP.23-35
Views: 0 Downloads: 0
Author(s)
Rishabh Dudheria
1,*
Index Terms
Security, MitM attack, Mobile apps, Phone number verification, Password reset, Privacy
Abstract
Mobile apps are gaining in popularity and are becoming an indispensable part of our digital lives. Several mobile apps (such as messaging apps) contain personal/private information of the users. Inevitably, the compromise of accounts associated with such sensitive apps can result in disastrous consequences for the end user. Recently, Password Reset Man-in-the-Middle (PRMitM) attack was proposed at the application level in which an attacker can take over a user’s web account while the user is trying to access/download resources from the attacker’s website. In this work, we adapt this attack so that it can be applied in the context of mobile messaging apps. Specifically, we analyze 20 popular mobile messaging apps for vulnerability to MitM attack, 10 of which support secure communication through end-to-end encryption. Based on our holistic analysis, we have identified 10 of the tested apps as being vulnerable to MitM attack and elaborated on the corresponding attack scenarios. On comparing the secure messaging apps to non-secure messaging apps for vulnerability to MitM attack, we found that an app’s features and design choices decide if it is susceptible to MitM attack irrespective of whether it provides end-to-end encryption or not. Further, we have proposed design improvements to increase the overall security of all mobile messaging apps against MitM attack.
Cite This Paper
Rishabh Dudheria, "Assessing Vulnerability of Mobile Messaging Apps to Man-in-the-Middle (MitM) Attack", International Journal of Computer Network and Information Security(IJCNIS), Vol.10, No.7, pp.23-35, 2018. DOI:10.5815/ijcnis.2018.07.03
Reference
[1]Simon Khalaf and Lali Kesiraju, “U.S. Consumers Time-Spent on Mobile Crosses 5 Hours a Day,” Flurry Analytics, Tech. Rep., Mar. 2017. [Online]. Available: http://flurrymobile.tumblr.com/post/157921590345/us-consumers-time-spent-on-mobile-crosses-5
[2]Simon Khalaf, “On Their Tenth Anniversary, Mobile Apps Start Eating Their Own,” Flurry Analytics, Tech. Rep., Jan. 2017. [Online]. Available: http://flurrymobile.tumblr.com/post/155761509355/on-their-tenth-anniversary-mobile- apps-start
[3]Messenger - Text and Video Chat for Free. Facebook. (Dec. 2017). [Online]. Available: https://play.google.com/store/apps/details?id=com.facebook.orca
[4]WhatsApp Messenger. WhatsApp Inc. (Dec. 2017). [Online]. Available: https://play.google.com/store/apps/ details?id=com.whatsapp
[5]N. Gelernter, S. Kalma, B. Magnezi, and H. Porcilan, “The Password Reset MitM Attack,” in 2017 IEEE Symposium on Security and Privacy, SP 2017, May 2017, pp. 251–267.
[6](2017, Oct.) End-to-end encryption. Wikipedia. [Online]. Available: https://en.wikipedia.org/wiki/End-to-end_ encryption
[7]P. Grassi, M. Garcia, and J. Fenton, Digital Identity Guidelines, National Institute of Standards and Technology (NIST) Std. 800-63-3, June 2017.
[8]Joseph Schwartz. (2016, May) The Most Popular Messaging App in Every Country. SimilarWeb. [Online]. Available: https://www.similarweb.com/blog/worldwide- messaging-apps
[9]Alisia Watson. (2016, Sep.) 12 Most Used Messaging Apps. engadget.[Online].Available: https://www.engadget. com/2016 /09/30/12-most-used-messaging-apps/
[10]Leslie Walker. (2017, Jul.) The 10 Best Mobile Messaging Apps. lifewire. [Online]. Available: https://www.lifewire.com/best-mobile-messaging-apps-2654839
[11]Google Play. Google Inc. (Dec. 2017). [Online]. Available: https://play.google.com/store?hl=en
[12](2016, Oct.) Snapchat, Skype among apps not protecting users privacy. Amnesty International. [Online]. Available: https://www.amnesty.org/en/latest/news/2016/10/snapchat-skype-among-apps-not-protecting-users-privacy/
[13](2017, Nov.) Comparison of instant messaging clients. Wikipedia.[Online].Available: https://en.wikipedia.org/wiki/Comparison_of_instant_messaging_clients
[14]A. Mylonas, A. Kastania, and D. Gritzalis, “Delegate the smartphone user? Security awareness in smartphone platforms,” Computers & Security, vol. 34, pp. 47–66, 2013.