Proj 7x: Plaintext Login (15 pts)

What You Need for This Project

Purpose

To observe network transmissions from an insecure app, and prove that they are not encrypted properly.

Background

This problem is gaining recognition, so few apps still have this flaw. Clear Messenger, which was used used in an earlier version of this project, but that app has been removed from Google Play, as of Feb 10., 2019.

So please use one of these apps instead. They all used plaintext network transmission on Feb 10, 2019, but eventually they may be fixed or removed.

Installing a Vulnerable App

On your Android device, in Google Play, find and install one of these apps, as shown below.

Trader Joe's Fan

Equity Pandit

(Use "Create Account" page to see password)

Stock Screener: Stock Analyst

(Uses SHA-1 hash of password)

Drink Mixer FREE drink recipes

Recipes by Ingredients

Diet Plan

Starting Wireshark

On your host system, launch Wireshark. If you don't have it, get it at:

https://www.wireshark.org/

In the main Wireshark window, double-click the network interface that is being used to reach the Internet. On my system, it is "Wi-Fi: en0", outlined in green in the image below.

Wirehark starts displaying packets. At the top, in the Filter bar, enter this display filter: 

http
Press Enter to filter the traffic.

On your Android device, in the vulnerable app, submit these login credentials, as shown below

Wireshark shows a captured POST request, as shown below.

Troubleshooting

If you don't see any packets, try these fixes:
  • Click the red square button to stop the capture
  • From the menu, click Capture, Options
  • Choose a different network adapter
  • If the "Link-layer header" is set to "802.11...", scroll to the right and uncheck the monitor box
In the top pane of Wireshark, right-click the POST request, and click Follow, "TCP Stream", as shown above.

The request appears, containing YOUR NAME, as shown below.

Saving a Screen Image

Make sure the captured username and password (or a SHA-1 hashed password) are visible, as shown above.

Save a full-desktop image. On a Mac, press Shift+Commmand+3. On a PC, press Shift+PrntScrn and paste into Paint.

YOU MUST SUBMIT A FULL-SCREEN IMAGE FOR FULL CREDIT!

Save the image with the filename "YOUR NAME Proj 7x", replacing "YOUR NAME" with your real name.

Turning in your Project

Email the image to to cnit.128sam@gmail.com with the subject line: Proj 7x from YOUR NAME
Last modified 2-10-19