TLS is not as universal as we might think. Applications with hundreds of millions of active users continue to use insecure, home-rolled proprietary network encryption to protect sensitive user data. This talk demonstrates that this is a widespread and systemic issue affecting a large portion of the most popular applications in the world. These issues are particularly concentrated in mobile applications developed in China, which have been overlooked by the global security community despite their massive popularity and influence.

To study this problem, I designed and implemented WireWatch, a pipeline to evaluate the network security of Android apps, for my PhD thesis dissertation. WireWatch measures apps’ usage of plaintext network traffic and non-standard, proprietary network cryptography. We found that 47.6% of top Mi Store applications used proprietary network cryptography without any additional encryption, compared to only 3.51% of top Google Play Store applications. We analyzed a variety of protocols from WireWatch, including cryptosystems designed by Alibaba, iQIYI, Kuaishou, and Tencent. Of the top 9 protocol families, we discovered vulnerabilities in 8 that allowed network eavesdroppers to decrypt underlying data. We also discovered additional vulnerabilities in several other protocols used by apps with hundreds of millions of users.

Through the vulnerabilities fixed as a result of this work, this research has directly improved the network security of up to one billion people. However, there were hundreds more proprietary protocols used by popular applications that we discovered. Verifying all of their security through manual reverse-engineering and vulnerability reporting is not feasible at this scale. What can we do as a community to fix this systemic issue and prevent such failures from occurring in the future?