[Android Q&A, Help & Troubleshooting] stimoceiver:
Hi,

I recently purchased a relatively generic Chinese MTK 6589 based phone, a Star S7589 5.8" screen.

And I notice some potentially serious issues with SSL on this phone. I've only had the phone a few days. There are a few minor annoyances, such as apps that use the face-facing camera not working. But what first led me to suspect something more serious might be wrong was when I tried to connect to my bank.

I signed in using the form on the main bank domain. The site uses a "verification image" on both mobile and full-sized versions of the page. But on this phone the verification image didnt load. But I figured, I dont exactly have much in the account so I entered my password. The password was rejected and it looped back to the banking site provider's login page which you cant log in from directly anyway.

So I tried loading up chrome from the app store. On chrome, I tried to follow the login procedure, but after entering my username on the main bank domain, I am greeted with an SSL error 107.

Firefox behaves similarly to the built in droid browser.

The bank also has an app. Not sure of its underlying connection mechanism but it is presumably SSL and it won't connect either.

After googling around a bit about error 107 and SSL MITM's, I found some threads here suggesting it was an issue for certain CyanogenMod roms. I'm using the factory rom (see below for version info.) The only app I could find on the play store to try to verify SSL certs or MITM presence was Kurt Huwig's SSL Verify:

url to play store -> play.google.com/store/apps/details?id=de.huwig.sslverify&hl=en

So I installed it. Here is the screenshot (aborted early because seemingly every 2nd or 3rd domain it checks returned "certificate mismatch"):

url to screenshot -> dumpt.com/img/viewer.php?file=s1tppuca9avpxtxqg50p.jpg

This is my 2nd phone from this vendor. 1st one wouldnt stay connected to the tower so I never had a chance to encounter this issue.

I am quite concerned about the possibility of these certificate chain errors reflecting intentional preloaded MITM capability.

I'm no newb to tech, security, or electronics, but my understanding of the mechanisms of certificates and the CA chain is far from that of a developer.

But one of the more paranoid of my friends, with equal or greater astuteness in the field of network security, upon learning I was experimenting with noname phones from China (my previous phone was a MTK 6577 that behaved flawlessly) had previously suggested that a lot of chinese phones come with pre-installed kernel vulnerabilities where certain rarely invoked syscalls run natively as root.

So needless to say, I'm posting this here in hopes that someone could offer an explanation for the output of SSL Verify that reflects a harmless, unintentional, and perhaps ubiquitous flaw in certain codebases as I found suggested in another xda-developer forum. As opposed to, my worst fear, an imminent threat to whatever percentage of android devices that have this vulnerability.

As suggested in that other thread I just tried creating a new APN with only the most minimal of parameters (both proxy fields blank etc.) when compared to the default which is presumably supplied by the tower/provider.

Non-SSL browsing seems perhaps slightly faster (will run a speed test later to verify) but doesnt help the SSL error 107 issue.

Running SSL Verify still shows the same list of certificates/signatures as mismatched as in the screenshot.

However I note, when watching the program run, that it is not ALL the domains that SSL verify checks - but it is roughly half of them. If anyone has a rational explanation for this - or knows of another app I could install to attempt to verify these results and/or SSL MITM vulnerabilities in general - please let me know.

from "about phone" page:

Model number: v89_jbl1a698

Android Version: 4.2.1

Baseband Version: MOLY.WR8.W1248.MD.WG.MP.V6.P4, 22013/04/12 17:49

Kernel Version: 3.4.5 root@android #1 Mon Apr 22 11:15:49 CST 2013

Build number: v89_jbl1a698_20130422