Become a fan of Slashdot on Facebook

 



Forgot your password?
typodupeerror
Check out the new SourceForge HTML5 internet speed test! No Flash necessary and runs on all devices. ×
Bug IOS Cellphones Handhelds Iphone Networking Open Source Privacy Security Software

Networking Library Bug Breaks HTTPS In ~1,500 iOS Apps 73

mrflash818 writes: A new report from analytics service SourceDNA found that roughly 1,500 iOS apps (with about 2 million total installs) contain a vulnerability that cripples HTTPS and makes man-in-the-middle attacks against those apps easy to pull off. "The weakness is the result of a bug in an older version of the AFNetworking, an open-source code library that allows developers to drop networking capabilities into their apps. Although AFNetworking maintainers fixed the flaw three weeks ago with the release of version 2.5.2, at least 1,500 iOS apps remain vulnerable because they still use version 2.5.1. That version became available in January and introduced the HTTPS-crippling flaw."
This discussion has been archived. No new comments can be posted.

Networking Library Bug Breaks HTTPS In ~1,500 iOS Apps

Comments Filter:
  • by GrahamCox ( 741991 ) on Wednesday April 22, 2015 @12:05AM (#49525549) Homepage
    iOS has perfectly functional networking libraries and simple objects that provide an API to them. Why anyone would bother linking in a 3rd party library to replicate that functionality I can't understand. If a vulnerability were found in the iOS libraries, Apple could roll out an update and fix it overnight. As it is, that's ~1500 apps need to be revved.
    • by Njovich ( 553857 )

      I don't know why you would say that it's good. Especially early in IOS history it was pretty annoying to write basic networking functionality like downloading and saving a file that's too large to keep in memory. The whole reason people used libraries like these is because Apples API weren't easy enough to use.

      • by GrahamCox ( 741991 ) on Wednesday April 22, 2015 @01:09AM (#49525705) Homepage
        iOS 2.0 added NSURLConnection. iOS 7 added NSURLSession. Downloading chunks of data and saving them to a file is trivial with the latter, still pretty easy with the former. I'm not sure what you needed to do prior to iOS 2, but that's ancient history - I doubt anyone is still supporting back that far. Point is, using a 3rd party library today when there are straightforward classes to do it in Foundation that have been debugged already by Apple (and will continue to be so) is the only really sensible option. Even if you're writing cross-platform it's easy enough to create equivalent objects you can interface to that wrap other networking solutions on non-iOS devices.
        • by Njovich ( 553857 )

          I think we are actually on the same page, I also never used networking libraries, but I can't blame people that did. NSURLConnection really was lacking.

          Yeah, it was all possible, but when you searched for IOS networking problems on sites like Stackoverflow for networking related issues, you would often get answers that just gave a couple of lines of AFNetworking code to fix something that was a PITA in NSURLConnection.

          If NSURLConnection really was that good, people wouldn't have bothered with libraries for

        • ... and anything from iPhone 4 upwards can use iOS 7. There is practically no reason not to write for IOS 7 exclusively, since nobody with iOS 6 is going to buy any apps anymore.
          • ... and anything from iPhone 4 upwards can use iOS 7. There is practically no reason not to write for IOS 7 exclusively, since nobody with iOS 6 is going to buy any apps anymore.

            As of February of this year, all new app releases MUST target iOS 7 or higher as well as support 64 bit

          • anything from iPhone 4 upwards can use iOS 7

            Except for the iPod touch 4, which doesn't have enough RAM to run iOS 7.

        • by tlhIngan ( 30335 )

          I'm not sure what you needed to do prior to iOS 2, but that's ancient history - I doubt anyone is still supporting back that far

          You did nothing. You couldn't write apps for iPhone OS 1.x because iPhone OS 2.0 introduced the app store. So unless you jailbroke, you only wrote apps against iPhone OS 2.0.

    • iOS has perfectly functional networking libraries and simple objects that provide an API to them.

      Not for doing anything even the slightest bit complex. Like, for example, certificate pinning and certificate validation, which is what AFNetworking fucked up.

      Do you think Apple is better? The APIs are shit. They are horribly documented. They don't "just work" with the high level Objective C APIs, but require a lot of low-level tinkering. They don't perform revocation checks consistently [stackoverflow.com].

      People use AFNetworking

  • What about every app that does a HTTP gets the wrong content-type? http://stackoverflow.com/quest... [stackoverflow.com]
  • Is there a way that I can download en masse apps on the app store to find which libraries they contain and perform other analysis of them?

Kill Ugly Processor Architectures - Karl Lehenbauer

Working...