How a malicious app can hijack other apps’ internet connections

What is it about?

Can a malicious app interfere with other apps’ internet communications without administrator privileges or permission to monitor their traffic? We show that it can, by cooperating with an attacker elsewhere on the network. Ordinary operating-system features reveal clues that help the attacker impersonate legitimate servers. We demonstrate attacks that hijack new TCP connections—the connections used by many internet services—on Windows, Linux, Android, macOS and iOS. We also demonstrate DNS cache poisoning on Windows, Linux and Android: planting false entries in a device’s internet address book to redirect connections to attacker-controlled servers.

Featured Image

Photo by FlyD on Unsplash

Photo by FlyD on Unsplash

Why is it important?

Computers and phones are designed to keep applications and users isolated from one another. Our findings show how weaknesses in shared networking features can undermine that separation, even when a malicious app has limited permissions. The risk concerns communications that lack appropriate cryptographic protection; the attacks do not break HTTPS encryption. The research highlights the need for stronger isolation within operating systems and secure communication protocols in applications. We reported our findings to Microsoft, Apple, Google and the Linux developers, leading to several security patches.