This is a fork of the nogotofail project also found on GitHub (https://github.com/google/nogotofail). This project adds tests for detecting common privacy issues in mobile application network traffic.
Cleartext data handlers are being triggering when PII is found in HTTPS traffic. This appears to be due to the HTTP cleartext handlers currently not be aware if SSL is used for the connection.
When generating the application pii data report unencrypted query strings for a domain are retrieved from the event log (dictionary) each the domain item is found in the log. This should be improved to pre-fetch the list of query strings for all domain before the report is processed.
This could be a performance issue for large event log files.
There is now the need to add tests for PII in encrypted HTTPS traffic. These tests are needed to detect issues such as user's identifying information combined with persistent identifiers in requests, and tracking of accumulated PII to advertising providers.
The names of the handlers for unencrypted PII in HTTP traffic need to be improved to accommodate these. The suggested handler name changes are:
VULN_PII_QUERY_STRING_DETECTION = "piiquerystringdetection"
VULN_PII_HTTP_HEADER_DETECTION = "piihttpheaderdetection"
VULN_PII_HTTP_BODY_DETECTION = "piihttpbodydetection" TO
Android studio editor settings appeared to have modified the formatting of the Android client "differences" (diffs) in Git commits creating messy diffs i.e. changes in indenting, spaces and mis-leading changes. This makes it very difficult to follow the change history.
The IDE editor auto-format settings should have been disabled.
The Java files should be reconstructed from the original source as a base and applying changes made.
Need to generate notifications for selected ciphers not using key exchange techniques not supporting forward secrecy i.e. not using ephemeral Diffie-Hellman DHE & ECDHE.
Selected ciphers is the cipher negotiated between the client and server in the TLS Server Hello message.
noforwardsecrecy handler log messages don't show the domain/hostname for which the TLS session was negotiated with. This makes it difficult to identify the connection with the issue.
This needs to be added to application message log i.e. mitm.log.
The Python script generating the PII data report (pii_data_report) is running fine on Ubuntu 14.04 LTS, however it is error-ing on Debian 7.8 (tested on the GCE Debian Wheezy image).
The nogotofail GCE install process is failing on running the install on Ubuntu 14.04 and Debian 8.0 instances. The issue appears to be when install a OpenVPN patch.
Device information sent by client doesn't match format used by server. The client sends location has an element in the "Personal-Details" dictionary, and the server changes this structure to create it's own "PII-Location" dictionary.
The project README.md file needs a link to the PII analysis document (nogotofail-pii/docs/pii_analysis.md) to allow users to jump to more detailed information about using PII handlers.
HTTPS PII detection handlers are needed to detect issues with mobile apps providing inappropriate amounts of user's personal information to server providers e.g. advertisers.
Additional code is needed to process the new HTTPS PII events in the data reporting code.
The current JSON PII summary report contains alot of information however it is complicated. A simpler layout would make it clearer what privacy impacts are present in applications.
Currently the mitm client app retrieves the 'last known location' for the device. However if the last known location isn't set (e.g. after the Android device has been rebooted) the app returns null.
The apps functionality should be improved to fetch for the current location if no 'last known location' is available.
Entries in the output log file (mitm.log) when clear-text location is found in HTTP traffic includes the string "(longitude/latitude)".
The extra pair of round-brackets makes the log entry format inconsistent with the standard format, and adds to the difficulty of processing the file.