0

I'd like to inspect the network usage of my apps (e.g., a banking app) to determine the security protocols they employ (if HTTPS: TLS layer version, encryption protocol, key size, signature algorithm, if multiple cipher-suits are supported, then suit preference--mandatory/preferred FS support--etc.).

In a browser, that's easy; not so much for standalone apps, which for all I know might not be using modern protocols.

Are there apps that listen to- and analyze network activity for that information?

  • There could be something like Wireshark for Android but there is also Fiddler that can act as a proxy and even decrypt HTTPS streams, if set up correctly. – GiantTree Sep 27 '16 at 8:07
  • @GiantTree I'd be very surprised (alarmed, even) if any setup of Fiddler could decrypt a banking app's stream on the fly (that would require the app to ignore an untrusted certificate), but in essence that's what I want. Does it allow for protocol analysis regardless of the security implementation? (I.e., in the expected case where the app refuses the connection when Fiddler tries to decrypt HTTPS, can Fiddler still identify the cipher suit without decrypting?) – Jonathan Y. Sep 27 '16 at 8:26
  • I don't think Fiddler can do that specifically (I have to look into it again). Fiddler generates a custom root certificate, so it can be the MITM and decrypt the connection. – GiantTree Sep 27 '16 at 8:35
0

There are Android apps available that can act as VPN service on the Android device itself (even without root). Afterwards all traffic is redirected through that app.

The app captures and displays the proxy, allowing you to detect unencrypted data.

Available Apps:

Packet Capture

On the step "SSL Decryption" select "skip", otherwise your SSL connections will be intercepted and decrypted.

Apps that use correctly protected SSL/TLS connections will fail while Packet Capture is running and capturing the data.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.