Book chapter
When TLS Meets Proxy on Mobile
Applied Cryptography and Network Security, pp.387-407
Lecture Notes in Computer Science, Springer International Publishing
08/29/2020
DOI: 10.1007/978-3-030-57878-7_19
Abstract
Increasingly more mobile browsers are developed to use proxies for traffic compression and censorship circumvention. While these browsers can offer such desirable features, their security implications are, however, not well understood, especially when tangled with TLS in the mix. Apart from vendor-specific proprietary designs, there are mainly 2 models of using proxies with browsers: TLS interception and HTTP tunneling. To understand the current practices employed by proxy-based mobile browsers, we analyze 34 Android browser apps that are representative of the ecosystem, and examine how their deployments are affecting communication security. Though the impacts of TLS interception on security was studied before in other contexts, proxy-based mobile browsers were not considered previously. In addition, the tunneling model requires the browser itself to enforce certain desired security policies (e.g., validating certificates and avoiding the use of weak cipher suites), and it is preferable to have such enforcement matching the security level of conventional desktop browsers. Our evaluation shows that many proxy-based mobile browsers downgrade the overall quality of TLS sessions, by for example allowing old versions of TLS (e.g., SSLv3.0 and TLSv1.0) and accepting weak cryptographic algorithms (e.g., 3DES and RC4) as well as unsatisfactory certificates (e.g., revoked or signed by untrusted CAs), thus exposing their users to potential security and privacy threats. We have reported our findings to the vendors of vulnerable proxy-based browsers and are waiting for their response.
Details
- Title: Subtitle
- When TLS Meets Proxy on Mobile
- Creators
- Joyanta Debnath - University of IowaSze Yiu Chau - Chinese University of Hong KongOmar Chowdhury - University of Iowa
- Resource Type
- Book chapter
- Publication Details
- Applied Cryptography and Network Security, pp.387-407
- Publisher
- Springer International Publishing; Cham
- Series
- Lecture Notes in Computer Science
- DOI
- 10.1007/978-3-030-57878-7_19
- eISSN
- 1611-3349
- ISSN
- 0302-9743
- Language
- English
- Date published
- 08/29/2020
- Academic Unit
- Computer Science
- Record Identifier
- 9984259500002771
Metrics
15 Record Views