Gmail users on iOS at risk of data interception
July 11, 2014 – 7:22 AMApple users accessing Gmail on mobile devices could be at risk of having their data intercepted, a mobile security company said Thursday.
The reason is Google has not yet implemented a security technology that would prevent attackers from viewing and modifying encrypted communications exchanged with the Web giant, wrote Avi Bashan, chief information security officer for Lacoon Mobile Security, based in Israel and the U.S.
Websites use digital certificates to encrypt data traffic using the SSL/TLS (Secure Sockets Layer/Transport Layer Security) protocols. But in some instances, those certificates can be spoofed by attackers, allowing them to observe and decrypt the traffic.
That threat can be eliminated through certificate “pinning,” which involves hard coding the details for the legitimate digital certificate into an application.
Unlike for Android, Google doesn’t do this for iOS, which means an attacker could execute a man-in-the-middle attack and read encrypted communications, Bashan wrote. Google acknowledged the problem after being notified by Lacoon on Feb. 24, but the problem has not been fixed, he wrote.
You must be logged in to post a comment.