How to fix Unsafe implementantion of TrustManager? - android-security

Question

My app was rejected in Google Play because some unsafe implementation of TrustManager.
But in my library I have only one implementation of TrustManager (this is my SSLUtil class).
import android.content.Context;
import java.io.InputStream;
import java.security.KeyStore;
import java.security.cert.Certificate;
import java.security.cert.CertificateFactory;
import javax.net.ssl.HostnameVerifier;
import javax.net.ssl.HttpsURLConnection;
import javax.net.ssl.SSLContext;
import javax.net.ssl.SSLSession;
import javax.net.ssl.SSLSocketFactory;
import javax.net.ssl.TrustManagerFactory;
public class SSLUtil {
/**
* #param ctx
* #param certRaw File from /res/raw
* #return
* #throws Exception
*/
public static SSLSocketFactory trustCert(Context ctx, int certRaw) throws Exception {
// Load CAs from an InputStream
CertificateFactory cf = CertificateFactory.getInstance("X.509");
// File at /res/raw
InputStream caInput = FileUtils.readRawFile(ctx, certRaw);
Certificate ca;
try {
ca = cf.generateCertificate(caInput);
} finally {
caInput.close();
}
// Create a KeyStore containing our trusted CAs
String keyStoreType = KeyStore.getDefaultType();
KeyStore keyStore = KeyStore.getInstance(keyStoreType);
keyStore.load(null, null);
keyStore.setCertificateEntry("ca", ca);
// Log.d(TAG, "KeyStore: " + keyStore);
// Create a TrustManager that trusts the CAs in our KeyStore
String tmfAlgorithm = TrustManagerFactory.getDefaultAlgorithm();
TrustManagerFactory tmf = TrustManagerFactory.getInstance(tmfAlgorithm);
tmf.init(keyStore);
// Create an SSLContext that uses our TrustManager
SSLContext context = SSLContext.getInstance("TLS");
context.init(null, tmf.getTrustManagers(), null);
// Create all-trusting host name verifier
HostnameVerifier allHostsValid = new HostnameVerifier() {
public boolean verify(String hostname, SSLSession session) {
return true;
}
};
// Install the all-trusting host verifier
HttpsURLConnection.setDefaultHostnameVerifier(allHostsValid);
SSLSocketFactory socketFactory = context.getSocketFactory();
HttpsURLConnection.setDefaultSSLSocketFactory(socketFactory);
return socketFactory;
}
}
I wrote this class after read the following docs from Android developer site:
https://developer.android.com/training/articles/security-ssl.html
If I understand it correctly, this code is ok. Is this implementation of TrustManager right?
I didn't understand why my application was rejected.

Answer 1

No, your code is not secure. As you can tell from the name allHostsValid, the code blindly accepts all hostnames, meaning that the connection can be man-in-the-middled. You should remove this class.