Android HTTPS锟叫硷拷锟剿劫筹拷漏锟斤拷浅锟斤拷

锟斤拷源锟斤拷锟斤拷锟斤拷锟斤拷锟斤拷|锟斤拷时锟戒：2015-03-19 11:13:19 |锟斤拷锟侥讹拷锟斤拷148锟斤拷|锟斤拷锟斤拷签锟斤拷漏锟斤拷锟斤拷 |锟斤拷锟斤拷锟斤拷锟斤拷锟斤拷

Android HTTPS中间人劫持漏洞浅析

Android HTTPS锟叫硷拷锟剿劫筹拷漏锟斤拷锟斤拷锟斤拷

锟斤拷锟斤拷锟斤拷学锟酵硷拷锟斤拷锟斤拷锟饺拷锟斤拷锟斤拷校锟斤拷屑锟斤拷斯锟斤拷锟� 锟斤拷 Man-in-the-middle attack锟斤拷通锟斤拷锟斤拷写为MITM 锟斤拷锟斤拷指锟斤拷锟斤拷锟斤拷锟斤拷通讯锟斤拷锟斤拷锟剿分别创斤拷锟斤拷锟斤拷锟斤拷锟斤拷系锟斤拷锟斤拷锟斤拷锟斤拷锟斤拷锟斤拷锟秸碉拷锟斤拷锟斤拷锟捷ｏ拷使通讯锟斤拷锟斤拷锟斤拷锟斤拷为锟斤拷锟斤拷锟斤拷锟斤拷通锟斤拷一锟斤拷私锟杰碉拷锟斤拷锟斤拷锟斤拷苑锟街憋拷佣曰锟斤拷锟斤拷锟斤拷锟绞碉拷锟斤拷锟斤拷锟斤拷峄帮拷锟斤拷锟斤拷锟斤拷锟斤拷锟斤拷锟饺拷锟斤拷啤锟斤拷锟斤拷屑锟斤拷斯锟斤拷锟斤拷校锟斤拷锟斤拷锟斤拷呖锟斤拷锟斤拷锟斤拷锟酵ㄑ端拷锟斤拷锟酵拷锟斤拷锟斤拷锟斤拷锟斤拷碌锟斤拷锟斤拷荨锟�

Android HTTPS锟叫硷拷锟剿癸拷锟斤拷漏锟斤拷源锟节ｏ拷

1. 没锟叫讹拷SSL证锟斤拷锟斤拷锟叫ｏ拷椋� 2. 没锟叫讹拷锟斤拷锟斤拷锟斤拷锟斤拷校锟介； 3. 证锟斤拷浞拷锟斤拷锟�(Certification Authority)锟斤拷锟斤拷锟斤拷锟斤拷锟斤拷私钥泄露锟饺★拷锟斤拷锟斤拷锟竭匡拷通锟斤拷锟叫硷拷锟剿癸拷锟斤拷锟斤拷锟斤拷取锟剿伙拷锟斤拷锟斤拷锟斤拷锟侥★拷锟斤拷锟斤拷锟斤拷锟捷★拷通讯锟斤拷址锟斤拷锟界话锟斤拷锟斤拷锟皆硷拷锟斤拷锟矫匡拷支锟斤拷锟斤拷息锟斤拷锟斤拷锟斤拷锟斤拷息锟斤拷锟斤拷锟斤拷通锟斤拷锟叫硷拷锟剿劫持斤拷原锟斤拷锟斤拷息锟芥换锟缴讹拷锟斤拷锟斤拷锟接伙拷锟斤拷锟斤拷锟斤拷锟斤拷锟斤拷源锏皆讹拷炭锟斤拷啤锟斤拷锟斤拷锟桔费等癸拷锟斤拷锟斤拷图锟斤拷

锟节革拷锟斤拷漏锟斤拷平台锟较ｏ拷锟叫达拷锟斤拷锟斤拷锟斤拷HTTPS证锟介不校锟斤拷漏锟斤拷锟斤拷锟斤拷锟斤拷锟斤拷诰锟斤拷蟛糠锟紸ndroid APP锟斤拷锟斤拷锟斤拷锟斤拷锟斤拷锟斤拷证锟斤拷漏锟斤拷锟斤拷锟斤拷锟斤拷逊锟斤拷锟铰官凤拷Android锟斤拷锟斤拷锟揭伙拷锟斤拷锟斤拷锟斤拷锟斤拷锟街わ拷锟铰╋拷锟斤拷锟結ahoo锟脚伙拷锟节癸拷锟节凤拷锟斤拷锟斤拷锟斤拷SSL锟叫硷拷锟剿癸拷锟斤拷锟斤拷携锟斤拷锟斤拷锟斤拷锟斤拷锟斤拷锟斤拷Android锟酵伙拷锟斤拷https未校锟斤拷证锟介导锟斤拷https通锟斤拷锟斤拷锟斤拷锟斤拷全锟斤拷锟斤拷锟斤拷

影锟届范围

Android系统

漏锟斤拷锟斤拷锟斤拷

1)锟叫硷拷锟剿癸拷锟斤拷漏锟斤拷位锟斤拷:

X509TrustManager 锟斤拷HostnameVerifier 锟斤拷 setHostnameVerifier (X509HostnameVerifier hostnameVerifier)

2) 漏锟斤拷锟斤拷锟斤拷前锟斤拷锟斤拷锟斤拷锟斤拷

锟皆讹拷锟斤拷锟絏509TrustManager锟斤拷校锟斤拷证锟介；锟斤拷实锟街碉拷锟皆讹拷锟斤拷HostnameVerifier锟斤拷校锟斤拷锟斤拷锟斤拷锟斤拷锟斤拷锟斤拷锟斤拷锟斤拷锟斤拷锟斤拷锟斤拷使锟斤拷setHostnameVerifier (ALLOW_ALL_HOSTNAME_VERIFIER)锟斤拷

3) 漏锟斤拷原锟斤拷锟斤拷

锟斤拷锟节客伙拷锟斤拷没锟斤拷校锟斤拷锟斤拷锟剿碉拷证锟介，锟斤拷斯锟斤拷锟斤拷呔锟斤拷锟斤拷锟酵ㄑ讹拷锟斤拷锟斤拷朔直鸫唇锟斤拷锟斤拷锟斤拷锟斤拷锟较碉拷锟斤拷锟斤拷锟斤拷锟斤拷锟斤拷锟斤拷盏锟斤拷锟斤拷锟斤拷荩锟绞雇ㄑ讹拷锟斤拷锟斤拷锟斤拷锟轿拷锟斤拷锟斤拷锟斤拷锟酵拷锟揭伙拷锟剿斤拷艿锟斤拷锟斤拷锟斤拷锟皆凤拷直锟接对伙拷锟斤拷锟斤拷锟斤拷实锟斤拷锟斤拷锟斤拷锟结话锟斤拷锟斤拷锟斤拷锟斤拷锟斤拷锟斤拷全锟斤拷锟狡★拷锟斤拷锟叫硷拷锟剿癸拷锟斤拷锟叫ｏ拷锟斤拷锟斤拷锟竭匡拷锟斤拷锟斤拷锟斤拷通讯双锟斤拷锟斤拷通锟斤拷锟斤拷锟斤拷锟斤拷锟铰碉拷锟斤拷锟捷★拷

小锟斤拷锟狡硷拷锟侥讹拷