Insecure communication in mobile apps involves the transfer of sensitive data over unencrypted channels, which can be exploited by threat actors such as malware and local adversaries. Key reasons for insecure communication include poor handshaking, weak re-negotiation, intercepting traffic, and transmission of plaintext data. To prevent vulnerabilities, it is essential to use industry-standard ciphers, trusted certificates, and secure SSL/TLS practices.

1. M3: Insecure
Communication

2. Meet The Team
2
Gayan Gothama Thisaranga Dilshan

3. What is Insecure
Commiunication?
1

4. What is Insecure
Commiunication?
A client –server model is often used to
exchange date in Mobile Apps
Which must be transferred via internet
securely
Transferring these data via unencrypted
channels and as plain text can be mostly
dangerous.
4

5. Threat Agents
2

6. Threat Agents
Threat actors may take advantage of
vulnerabilities in the system to intercept
sensitive data as it transmit across the
internet.
1. A malware
2. Network devices (routers, cell towers)
3. An adversary that shares local network
(Compromised WiFi / Monitored WiFi)
6

7. Insecure
Communication
Reasons
3

8. Insecure Communication Reasons
1. Poor Handshaking
2. Weak Re-negotiation
3. Intercepting traffic
4. Plaintext Data Communication
8

9.  Every TLS/SSL connection stats with a handshake
 Handshake contains the rules for secure connection
 Server side configuration is crucial in this case and
here are some requirements,
i. Certificate is preferably not a wildcard domain
ii. Key length must be > 2048bits
iii. Allow secure protocols only (Ex:TSL V1.2)
iv. Allow only secure cipher suits (Ex:AES256
SHA2)
9
1. Poor Handshaking

10.  Renegotiation : The process of establishing a
new handshake when during the TLS/SSL link.
 The problem is that most mobile app
renegotiations aren't cryptographically
connected to the TLS/SSL link they're running
over.
 Attacker can inject a malicious code and trick
the server.
10
2. Weak Re-negotiation

11. Four Types of Renegotiations:
A. Client-initiated secure renegotiation.
B. Client-initiated insecure renegotiation.
C. Server-initiated secure renegotiation.
D. Server-initiated insecure renegotiation.
Two Main Problems of Renegotiations :
A. Man-in-the-middle Attack
B. DoS Attack
11

12. 12

13. 3. Intercepting Traffic
 There are several factors that should be
satisfied in order to intercept a mobile app
traffic.
1) Install the proxy’s CA certificate on device.
2) Configuring the workstation into a router.
3) Change Wi-Fi configuration of the device.
13

14. 4. Plaintext Data Communication
 Any application that contains
secret/sensitive information, must
not transmit data in plain text.
 Which will cause a sensitive
information disclosure
14

15. Am I Vulnerable
to Insecure
Communication?
4

16. 16
 Mainly effects to your Data Integrity and Data
Confidentiality
1) Eavesdropping
2) Offline Attacks
3) Certificate Checking Issues
4) Weak Ciphers

17. How To Prevent
Insecure
Communication?
5

18. 18
1) Use industry standard ciphers + key lengths
2) Only use trusted CA certificates
3) Perform a SSL Chain Verification at all times
4) Account external 3rd party entities
Ex: Analytics companies, Social networks
5) Use SSL/TLS in where channels used in mobile
to backend communication
6) Add extra layer of encryption before offering
data to SSL channel
General Practices

19. 19
1) Poor certificate inspection
2) Leakage of Privacy
3) Leakage of Confidentiality
Common Scenarios

20. Thanks!!
20