The Android application provided by Birebin.com fails to validate SSL certificates, allowing for a man in the middle attack.
81e80c5e05043304d6c894a1d4b7e354fd2d65ecc2596fb719e6c2d589f3019a
Title: Birebin.com Android App SSL certificate validation weakness
Advisory URL:http://sceptive.com/p/birebincom-android-app-ssl-certificate-validation-weakness-
== Overview
Birebin.com is an online betting web-site which also provides Android app. for the members to ease on betting.
We have found that Android app vulnerable to SSL mitm attacks (http://en.wikipedia.org/wiki/Man-in-the-middle_attack) which eventually let attackers to gather user name-password and session hijacking capabilities against app. users.
== Description
On misconfigured network environments it is possible to redirect HTTPS packets over MITM tools for SSL sessions.
When we redirected our network on such a configuration we have observed that app sends/receives user data unecrypted.
REQUEST
{
"Password": "123456",
"UserName": "abc@abc.com"
}
And also Token value which is used for session awarenes is vulnerable for attackers to use on their own configurations to hijack other users' sessions.
== Affected Version(s)
No verison is given in app. But we provide md5 hash of the vulnerable APK
MD5 (birebin-android-latest.apk) = 60bea6a1694b1ffc87c4dc3f2ba6a8be
== Fixes
No known fixes has been released yet.