Certificate Validation Flaw Leaves Instapaper Log-in Details At Risk

The Android version of popular news-saving app Instapaper is susceptible to man-in-the-middle attacks which could expose a user’s credentials when logging into an account according to security firm Bitdefender.

Researchers claim a certificate validation vulnerability mean user names and passwords could be stolen using a fake certificate and traffic intercepting tool, if an Instapaper logs into the app on a Wi-Fi network monitored by hackers.

Instapaper vulnerability

“The vulnerability may have serious consequences, as while the attacker might seem to only gain access to your Instapaper account, many people use the same password for multiple accounts,” said Catalin Cosoi, chief security strategist at Bitdefender. “A cybercriminal could try and use your Instapaper password to access your social media or email accounts.”

The application uses an SSLSocketFactory and a trust manager without a mechanism for certificate validation, meaning anyone could impersonate the server during client/server authentication and gain authentication credentials.

“The vulnerability lies not in the way the application fetches content but in the way it implements, or in this case, doesn’t implement, certificate validation,” adds Catalin Cosoi. “Although the entire communication is handled via HTTPS, the app performs no certificate validation. If someone were to perform a man-in-the-middle attack, they could use a self-signed certificate and start ‘communicating’ with the application.”

Instapaper told TechWeekEurope that the issue had been resolved as of Instapaper for Android 4.2.2 and that although the firm takes security “very seriously” the severity of this particular vulnerability was very low.

Bitdefender did not test the iOS version, but Instapaper assured us it was not affected as the iOS app uses Apple’s default frameworks for HTTP(S) requests, which handle certificate validation.

Are you a security pro? Try our quiz!