M05: Insecure Communication

📋 What Is It?

Insecure Communication occurs when mobile applications transmit sensitive data over unencrypted channels or fail to properly validate server certificates. This includes using HTTP instead of HTTPS, accepting invalid SSL certificates, and lacking certificate pinning. Mobile apps communicate over untrusted networks (public WiFi, cellular), making secure communication critical.

M05 OWASP Rank

73% Apps Affected

<30min Time to Exploit

⚠️ Common Exploits

Man-in-the-Middle (MITM): Intercept traffic on public WiFi
Certificate Spoofing: Present fake SSL certificates
Downgrade Attacks: Force HTTP instead of HTTPS
Traffic Sniffing: Capture unencrypted credentials/tokens
SSL Stripping: Remove HTTPS from connections
DNS Spoofing: Redirect to malicious servers

🔴 Attack Flow

1. Attacker sets up rogue WiFi hotspot
↓
2. User connects and launches app
↓
3. App sends HTTP request with credentials
↓
4. Attacker intercepts plaintext traffic
↓
5. BREACH: Credentials, tokens, PII stolen!

❌ Vulnerable Code

// Bad: Using HTTP instead of HTTPS (Android)
public void login(String username, String password) {
    // VULNERABLE: Unencrypted HTTP
    String url = "http://api.example.com/login";
    
    HttpClient client = new DefaultHttpClient();
    HttpPost post = new HttpPost(url);
    
    // Credentials sent in plain text!
    post.setEntity(new StringEntity(
        "username=" + username + "&password=" + password
    ));
}

// Bad: Accepting all SSL certificates (Android)
public void disableSSLVerification() {
    // VULNERABLE: Trust all certificates
    TrustManager[] trustAll = new TrustManager[] {
        new X509TrustManager() {
            public void checkClientTrusted(X509Certificate[] chain, String authType) {}
            public void checkServerTrusted(X509Certificate[] chain, String authType) {}
            public X509Certificate[] getCertificates() { return null; }
        }
    };
    
    SSLContext sc = SSLContext.getInstance("TLS");
    sc.init(null, trustAll, new SecureRandom());
}

// Bad: No certificate validation (iOS)
func urlSession(_ session: URLSession,
    didReceive challenge: URLAuthenticationChallenge,
    completionHandler: @escaping (URLSession.AuthChallengeDisposition, URLCredential?) -> Void) {
    
    // VULNERABLE: Accept any certificate
    completionHandler(.useCredential, URLCredential(trust: challenge.protectionSpace.serverTrust!))
}

// Bad: Mixed content (Android)
<application
    android:usesCleartextTraffic="true">  <!-- VULNERABLE: Allows HTTP -->
</application>

// Bad: Insecure WebSocket (JavaScript)
const socket = new WebSocket('ws://api.example.com');
// VULNERABLE: Unencrypted WebSocket connection
                

✅ Secure Code

// Good: Use HTTPS with certificate pinning (Android)
public void login(String username, String password) {
    // Use HTTPS only
    String url = "https://api.example.com/login";
    
    // Configure OkHttp with certificate pinning
    CertificatePinner pinner = new CertificatePinner.Builder()
        .add("api.example.com", "sha256/AAAAAAAAAA...")
        .build();
    
    OkHttpClient client = new OkHttpClient.Builder()
        .certificatePinner(pinner)
        .build();
}

// Good: Proper certificate validation (iOS)
func urlSession(_ session: URLSession,
    didReceive challenge: URLAuthenticationChallenge,
    completionHandler: @escaping (URLSession.AuthChallengeDisposition, URLCredential?) -> Void) {
    
    guard challenge.protectionSpace.authenticationMethod == 
          NSURLAuthenticationMethodServerTrust else {
        completionHandler(.performDefaultHandling, nil)
        return
    }
    
    // Validate certificate against pinned certificates
    if let serverTrust = challenge.protectionSpace.serverTrust,
       let certificate = SecTrustGetCertificateAtIndex(serverTrust, 0) {
        
        let serverCertData = SecCertificateCopyData(certificate) as Data
        let pinnedCertData = pinnedCertificate() // Load pinned cert
        
        if serverCertData == pinnedCertData {
            completionHandler(.useCredential, 
                            URLCredential(trust: serverTrust))
        } else {
            completionHandler(.cancelAuthenticationChallenge, nil)
        }
    }
}

// Good: Network Security Config (Android)
// res/xml/network_security_config.xml
<?xml version="1.0" encoding="utf-8"?>
<network-security-config>
    <!-- Disable cleartext traffic -->
    <base-config cleartextTrafficPermitted="false">
        <trust-anchors>
            <certificates src="system" />
        </trust-anchors>
    </base-config>
    
    <!-- Certificate pinning for API -->
    <domain-config>
        <domain includeSubdomains="true">api.example.com</domain>
        <pin-set>
            <pin digest="SHA-256">base64encodedpin==</pin>
            <pin digest="SHA-256">backuppin==</pin>
        </pin-set>
    </domain-config>
</network-security-config>

// AndroidManifest.xml
<application
    android:networkSecurityConfig="@xml/network_security_config"
    android:usesCleartextTraffic="false">
</application>

// Good: Secure WebSocket (JavaScript)
const socket = new WebSocket('wss://api.example.com');
// Use WSS (WebSocket Secure) instead of WS
                

✓ Prevention Checklist

Use HTTPS for all network communications
Implement certificate pinning for APIs
Disable cleartext traffic in app configuration
Validate SSL/TLS certificates properly
Use TLS 1.2 or higher, disable older versions
Implement proper certificate chain validation
Use secure WebSocket (WSS) instead of WS
Avoid accepting self-signed certificates in production
Monitor for certificate expiration
Test on public WiFi networks for vulnerabilities

🔍 Detection & Tools

Testing Tools:

Burp Suite OWASP ZAP mitmproxy Wireshark Charles Proxy Fiddler

Implementation Tools:

OkHttp Alamofire TrustKit Network Security Config SSL Labs

How to Test:

Set up Burp Suite/mitmproxy as intercepting proxy
Install custom CA certificate on test device
Monitor traffic for HTTP (unencrypted) requests
Test with invalid/expired SSL certificates
Verify certificate pinning bypasses are prevented
Use Wireshark to capture and analyze traffic

🌍 Real-World Breaches

Multiple Banking Apps (2018): Lack of cert pinning enabled MITM attacks
Skype (2015): Weak encryption allowed traffic interception
Snapchat (2014): Unencrypted API calls exposed user data on WiFi
Telegram (2016): Certificate validation bypass enabled MITM
WhatsApp (2017): Missing cert pinning in some versions exploited

📌 Quick Tips

DO NOT use HTTP for any sensitive data
DO NOT accept all SSL certificates
DO NOT disable certificate validation
DO enforce HTTPS for all communications
DO implement certificate pinning
DO use TLS 1.2+ with strong cipher suites

📜 Compliance

Related Standards:

PCI-DSS Requirement 4.1
GDPR Art. 32 - Encryption in Transit
HIPAA §164.312(e)(1)
NIST 800-52, 800-53 SC-8
OWASP MASVS MSTG-NETWORK-1 to 6
ISO 27001 A.10.1.1, A.13.1.1

📡 Insecure Communication