Android Tutorial [B4X] Tip - Modified server response

While analyzing a Crashlytics crash report of a small app of mine I was surprised to see the following error:

Fatal Exception: java.lang.NumberFormatException
For input string: "<html><head></head><body><script type="text/javascript">try{if(parent.document.location==document.location) window.location="xxxxx"referer=&startm=201203";}catch(e){}</script></body></html>

The app sends a request to a server implemented with B4J. The server responds with a number. The code looks like this:
B4X: 
Wait For (CreateJob(...)) JobDone(j As HttpJob)
       If j.Success Then
           SavedGroupInfo.GroupId = j.GetString '<--- crash here

The user internet provider modified the server response and returned a JavaScript that does something (it is related to "safe internet" feature).

Bottom line is that even if you are calling your own web service you cannot assume that the server response will not be modified...

BTW, I recommend adding Crashlytics to your apps. It provides more information than Google Play and the data is sent automatically.
 
Click to expand...

Harris

Expert
Licensed User
Longtime User
Geezzzz...
Was the response number wrapped up in the return somewhere?

I use the same method all the time to update the record (with return ID) to SENT. If it doesn't get updated, it will continue to be sent - forever.
 

OliverA

Expert
Licensed User
Longtime User
Erel said:
returned a JavaScript that does something (it is related to "safe internet" feature).
Click to expand...
Wow. How does this even make sense? So let's add some JavaScript to a return that had no JavaScript, since JavaScript is just so ridiculously safe (yes, that was sarcasm). BTW, I tried to search for this (wrapping HTTP returns in JavaScript), but could not find anything. Pointers would be welcome.
 

Erel

B4X founder
Staff member
Licensed User
Longtime User
Harris said:
Was the response number wrapped up in the return somewhere?
Click to expand...
No. The original link was included. My guess is that the JavaScript sends the URL to the "safe internet" server and then redirects to that page. I might be wrong here.
This of course doesn't work when the request is made outside of a browser.

OliverA said:
I tried to search for this (wrapping HTTP returns in JavaScript), but could not find anything. Pointers would be welcome.
Click to expand...
Search for JavaScript injection.
Example: https://stackoverflow.com/questions/4113268/stop-mobile-network-proxy-from-injecting-javascript
https://security.stackexchange.com/...ecting-strange-codes-to-every-website-i-visit

SSL doesn't help as they install their own certificate.
 

OliverA

Expert
Licensed User
Longtime User
Erel said:
Search for JavaScript injection.
Click to expand...
For some reason I was looking for additional JavaScript that helped with security and found no hits. The two samples listed show 1) ISP's injecting ads and 2) ISP's automatic bandwidth reduction scheme. The security aspect would be interesting to see, but I smell ... .
Erel said:
Bottom line is that even if you are calling your own web service you cannot assume that the server response will not be modified...
Click to expand...
Erel said:
SSL doesn't help as they install their own certificate.
Click to expand...
I guess this incident really shows that one really needs to host their site (via VPS or otherwise), use their own certificate and process EVERYTHING over HTTPS. If anything happens with this configuration, then your dealing with an actual MITM attack.
 

Erel

B4X founder
Staff member
Licensed User
Longtime User
In this case SSL doesn't help. I've checked the ISP instructions (in Hebrew). They include installing a custom certificate authority. This is indeed a MITM "attack".
 

OliverA

Expert
Licensed User
Longtime User
Erel said:
They include installing a custom certificate authority.
Click to expand...
In this case, I think they are injecting the JavaScript before the encryption. I could see that happening if it is a shared hosting system instead of a VPS. Of course, if they are doing that, they are totally cancelling out the benefits of a custom certificate authority. Now, if this is a VPS and this is still happening, then somehow the ISP has access to the VPS or they are really doing something clever here (not in a good sense though, since this would break the trust in HTTPS).
 

OliverA

Expert
Licensed User
Longtime User
Erel said:
Once the user installs your own root certificate
Click to expand...
That's the key though! Did the device that runs your "small app" do that? If it did not, the MITM should fail. Or is your app accepting all certificates? If so, that's defeating the purpose of HTTPS too. So if they inject JavaScript with a Proxy, it would break most accesses to the site, since I just can't see that everyone that visits that site just goes ahead and installs the Proxy's root CA. Now, I'm not contesting that deep pockets (state actor's) can't get around this by forging CA's, but in this case I'm pretty sure that 1) this is a shared web host, not a VPS and 2) that they are injecting the JavaScript before the encryption happens. BTW, I'm not picking a fight here, I'm just hoping to clarify some points, since if this were a true MITM (without having to install a root cert per device accessing the site) that is not discoverable when accessing the site via HTTPS and is capable of altering in-flight HTTPS content, we are having some huge issues here on the order of breaking the internet (the HTTPS portion).
 

Erel

B4X founder
Staff member
Licensed User
Longtime User
OliverA said:
Did the device that runs your "small app" do that?
Click to expand...
Yes. The customer is using an internet provider that provides a safe internet service. As part of this service they install a root certificate on the device. They install it once and this allows the internet provider to act as a man in the middle. The root certificate allows it to forge certificates of all sites.

OliverA said:
Or is your app accepting all certificates?
Click to expand...
No.
OliverA said:
this is a shared web host, not a VPS
Click to expand...
The app interacts with this server. It is a VPS with a valid certificate.

OliverA said:
BTW, I'm not picking a fight here
Click to expand...
Of course not. Don't worry
 
You must log in or register to reply here.

Similar Threads

Y
  • Article
Android Code Snippet [B4X] SMTP Errors
Replies
0
Views
665
yiankos1
Y
  • Locked
  • Question
B4J Question Error occurred For [B4X] Firebase Push Notifications 2023+ B4j Sending tools
Replies
3
Views
1K
Erel
  • Solved
Android Question [B4X] [XUI] Issue with xCustomListView with TextChanged event
Replies
7
Views
1K
Mahares
M
  • Article
Android Tutorial [B4X] Tip - ROBOCOPY error related to shared files folder
Replies
1
Views
4K
Richard Phipps
Games Crashlytics: How to avoid a java.lang.NullPointerException?
Replies
8
Views
2K
Gunther
Menu
Log in
Register
Cookies are required to use this site. You must accept them to continue using the site. Learn more…