1

My employer performs MITM on gmail.com by generating their own certificate authority. I've only noticed this applies to the web version of Gmail. In additon, Chrome on Windows will alert me when the certificate is not completely authentic.

Does this also apply to the Android App? Will the same MITM logic for gmail web work on the Android App, or is the app more secure? Note that I do not get the same certificate warnings on the app. It's hard to tell if my traffic is intercepted via the app. Are there any other methods that could be used to intercept and decrypt traffic from the Gmail android app?

Improve this question
1
  • It's hard to intercept on mobile data -- while it's thinkable with WiFi hotspots (in companies, I've already seen this web-MITM in some proxies, so they can scan what's going on -- though it's at least questionable if it's not agains the law doing so). But I've not heard of any case yet (which doesn't have to mean a thing, of course)...
    – Izzy
    Commented Jun 12, 2013 at 19:54

1 Answer 1

Reset to default
0

Indeed, overriding certificates it's one of the most popular ways to compromise https. So, if your employer can succeed to create a certificate that fools the app, it can easily perform a MiTM attack.

Some links to check about mitm attacks on gmail app:

Improve this answer
4
  • Is there a way to view the certificate authority currently being used by Gmail? How can I tell if MITM is in effect or not?
    – void.pointer
    Commented Jun 13, 2013 at 15:29
  • It is not the easiest thing in the world to confirm a MITM attack. Especially if it is "passive" which means that the attacker just monitors your data and not alters them. To be honest, I dont know where you can find the certificate authority for the app. Maybe it is hidden on purpose.
    – py_script
    Commented Jun 15, 2013 at 13:14
  • Hi Robert, I dont know which version of Android do you use, but on Android 4, you can go to settings->security and there is a Trusted credentials option there, where you can see the authorities used. But I couldnt connect them to specific apps
    – py_script
    Commented Jun 16, 2013 at 11:56
  • 1
    Thanks and sorry for the delay py_script. I was doing some background research on this myself. I ended up using wireshark to check the SSL handshake done by the Gmail app. I'm not able to see the root certificate in the chain for some reason, the top-most certificate is simply Google. So it is still not certain whether or not it is being intercepted.
    – void.pointer
    Commented Jun 26, 2013 at 14:56

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .