M3:2016 Insecure Communication

📋 What Is It?

Insecure Communication is any failure to protect data in transit between the app and the outside world. Mobile devices roam across networks their owner does not control - cafés, airports, hotels, captive portals, rogue hotspots - so every request travels through infrastructure an attacker may own. The category covers cleartext traffic, broken or disabled certificate validation, weak TLS configuration, and sensitive data leaving over non-HTTP channels such as SMS, Bluetooth, or NFC.

The most damaging pattern is validation disabled during development and never re-enabled: a trust-all manager that made a self-signed staging certificate work ships to production and quietly turns every network into a wiretap.

M3 OWASP Rank 2016

Hostile Networks By Default

MITM Primary Attack

⚠️ Common Exploits

Cleartext HTTP: analytics, images, updates, or "non-sensitive" calls over http://
Trust-All Managers: empty checkServerTrusted, ALLOW_ALL_HOSTNAME_VERIFIER
Ignored TLS Errors: WebView onReceivedSslError → proceed()
No Pinning: any CA-issued certificate is accepted, including a user-installed one
Weak TLS: obsolete protocol versions and cipher suites
Downgrade & Redirect: HTTPS endpoint redirects through cleartext
Side Channels: secrets sent via SMS, push payloads, Bluetooth, or NFC

🔴 Attack Flow

1. Put the device on an attacker-controlled network or proxy
↓
2. Present a proxy certificate and observe whether the app complains
↓
3. If it does not, read and rewrite every request and response
↓
4. Harvest credentials and tokens; inject modified responses
↓
5. IMPACT: Full interception - credentials stolen, content controlled!

❌ Vulnerable Code

// Bad: trust every certificate ever presented
val trustAll = object : X509TrustManager {
    override fun checkServerTrusted(c: Array<X509Certificate>, a: String) {}  ← accepts anything
    override fun checkClientTrusted(c: Array<X509Certificate>, a: String) {}
    override fun getAcceptedIssuers() = arrayOf<X509Certificate>()
}
builder.hostnameVerifier { _, _ -> true }          ← hostname never checked

// Bad: WebView told to continue past a TLS error
override fun onReceivedSslError(v: WebView, h: SslErrorHandler, e: SslError) {
    h.proceed()                                     ← ignores the warning entirely
}

// Bad: cleartext endpoints
val url = "http://api.example.com/v1/login"        ← credentials over the air

<!-- Bad: cleartext permitted app-wide -->
<application android:usesCleartextTraffic="true" />
<!-- Bad (iOS): NSAllowsArbitraryLoads = true -->
                

✅ Secure Code

// Good: default validation plus certificate/public-key pinning
val pinner = CertificatePinner.Builder()
    .add("api.example.com", "sha256/AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=")
    .add("api.example.com", "sha256/BBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBB=")  // backup pin
    .build()
val client = OkHttpClient.Builder().certificatePinner(pinner).build()

<!-- Good: network security config - HTTPS only, pinned, no user CAs -->
<network-security-config>
  <base-config cleartextTrafficPermitted="false">
    <trust-anchors><certificates src="system" /></trust-anchors>
  </base-config>
  <domain-config>
    <domain includeSubdomains="true">api.example.com</domain>
    <pin-set expiration="2026-12-31">
      <pin digest="SHA-256">AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=</pin>
      <pin digest="SHA-256">BBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBB=</pin>
    </pin-set>
  </domain-config>
</network-security-config>

// Good: never override the TLS error handler
override fun onReceivedSslError(v: WebView, h: SslErrorHandler, e: SslError) {
    h.cancel()                                     // fail closed, tell the user
}

# Good (iOS): keep ATS on, TLS 1.2+, forward secrecy, and pin
NSAppTransportSecurity: { NSAllowsArbitraryLoads: false }
                

✓ Prevention Checklist

Use HTTPS for every request - including images, analytics, and updates
Disallow cleartext traffic at the platform level, with no blanket exceptions
Never ship a trust-all manager or a permissive hostname verifier
Fail closed on TLS errors; never call proceed()
Pin certificates or public keys, with a backup pin and a rotation plan
Require TLS 1.2 or newer with forward-secret cipher suites
Reject user-installed CAs for your own API domains
Keep secrets out of URLs, push payloads, SMS, and Bluetooth/NFC channels
Guard debug-only network settings with build flags that cannot reach release
Verify with an intercepting proxy before every release

🔍 Detection & Tools

Interception:

Burp Suite mitmproxy Charles Proxy Wireshark

Analysis:

MobSF objection testssl.sh nscurl (iOS ATS)

How to Test:

Proxy the device with a user-installed CA - does the app still work?
Capture traffic and look for any http:// request
Present an invalid or expired certificate and confirm the app fails closed
Check the network security config / ATS settings in the built artifact
Try to bypass pinning with objection to confirm it is actually enforced

🌍 Real-World

These are documented incident classes - recurring patterns rather than single CVEs.

Trust-all managers shipped to production: validation disabled for a staging certificate makes every public Wi-Fi a wiretap.
Cleartext side channels: the login call is HTTPS but analytics, images, or update checks travel in the clear and leak identifiers and session data.
WebView TLS errors auto-proceeded: a single proceed() defeats transport security for all in-app web content.
No pinning on high-value flows: a user-installed or fraudulent CA certificate is enough to read and rewrite banking traffic.
Secrets over SMS or push: one-time codes and tokens delivered through channels other apps or carriers can observe.

📌 Quick Tips

DO NOT disable certificate or hostname validation, ever
DO NOT call proceed() on a TLS error
DO NOT allow cleartext "just for one endpoint"
DO pin keys with a backup pin and a rotation plan
DO require TLS 1.2+ with forward secrecy
DO proxy-test the app before each release

📜 Compliance

Related Standards:

OWASP Mobile Top 10 2016 - M3
Maps to M5:2024 Insecure Communication
OWASP MASVS NETWORK-1, NETWORK-2
CWE-319 Cleartext Transmission of Sensitive Information
CWE-295 Improper Certificate Validation
CWE-757 Selection of Less-Secure Algorithm During Negotiation

📡 Insecure CommunicationMobile 2016