Security experts at Lacoon discovered a vulnerability in the Gmail iOS app which enables a bad actor to perform a Man-in-the-Middle.
Google Gmail application for iOS is exposed to risks of Man-in-the-Middle (MitM) attacks which allow bad actors to monitor encrypted email communications.
An expert at mobile security firm Lacoon has discovered that version of Gmail for iOS based mobile device does not perform the certificate pinning procedure when establishing a trusted connection to the service provider, this means that an attacker can view plaintext emails and steal credentials in MitM attack, millions of its Apple device users are exposed to the risk of attack.
“By impersonating the legitimate server (i.e. performing a Man-in-the-Middle) through the usage of a spoofed SSL certificate, the threat actor can open up the encryption, view, and even modify, all communications in plain-text – including passwords, emails, and chats.“
“Several months after providing responsible disclosure, Google has not provided information regarding resolution and it still remains an open vulnerability,” “This vulnerability leaves iPhone and iPad users at risk of a threat actor being able to view and modify encrypted communications through a Man-in-the-Middle attack.” said Michael Shaulov, CEO and co-founder of Lacoon Mobile Security.
“The configuration profile is an extremely sensitive iOS file which allows [them] to re-define system functionality parameters such as device, mobile carrier and network settings. The root CA [certificate authority] is what enables the threat actor to create spoofed certificates of legitimate services,” said Avi Bashan. “It is important to note that the configuration profile is very simple to install. More so, many legitimate enterprise policies demand its installation.“
- Hacker tricks victim into installing a configuration profile containing the root certificate and the details of the server to reroute the traffic to. (Note: to do this, a threat actor can use a variety of social engineering methods such as sending an email, purportedly from the IT department, requesting to install the configuration profile.)
- Reroutes victim’s traffic through the server under the threat actor’s control, defined by the malicious configuration profile.
- Creates spoofed certificates which are identified as valid by the victim’s device.
- Intercepts all traffic between the attacked device and intended server.
- Check the configuration profiles of devices in your enterprise to ensure that they do not include root certificates.
- Ensure that employees use a VPN or any other secure channel when connecting to enterprise resources
- Perform on-device and network analysis to detect MitM attempts
Security Affairs – (Gmail, MITM)
Share On
