0

For instance, how would I check that YouTube for Android uses transport layer security TLS encryption?

Is there a network tool I can use to verify that encryption is used?

Improve this question

2 Answers 2

Reset to default
1

You can test by connecting to a Wireless network you control and using a sniffer (wireshark, tcpdump) on the wired side of the AP to watch the packets go through. While Android should prefer wireless over phone network, you can disable phone data services if it isn't doing so.

Let us know what you find!

Improve this answer
1

To test you need to capture network packets from wireshark or a similar tool. This can be run on your phone if you have rooted your phone. Alternatively, you can take an internet connected computer and setup an unused wifi/bluetooth card as a wifi/bluetooth hotspot (e.g., setup a wifi hotspot when the computer is directly connected to the internet through ethernet, or setup a bluetooth connection that shares internet between your phone and laptop if your laptop is connected to the internet through wifi). Then connect your phone to your laptops internet and start your wireshark capture. Then start up the particular mobile application and use it. Try not to have your computer or phone to have too much other internet activity at the time you are doing the capture. Filter through the collected packets by IP address (e.g., if you are looking up youtube, look at IPs that are associated with youtube). Check that everything generated by the application is sent over using TLS (note the protocol). See if data you want to keep secret is being sent unencrypted.

For the specific case of youtube app on android. No, the video and initial request to get a video is sent over unencrypted HTTP. (I just tested with wireshark using the youtube app on my nexus 7 running Android 4.4.2.) It does make an initial HTTPS connection, which I believe is used for logging you into your google account. However, when you request and watch a video, the traffic including the HTTP header that identifies the video is sent over unencrypted HTTP. The following is a captured HTTP request made at the start of TCP stream made with the youtube app (granted I altered my ip, and many of the other fields with fake data, so I didn't inadvertantly leak information like an active google session cookie, that I do not want to send). Note the &id=b7935aa6939a4137& part that is unchanged.

GET /videoplayback?ms=au&clen=22426616&key=yt5&mime=video%2F3gpp&ip=1.2.3.4&mv=m&ipbits=0
 &mws=yes&fexp=123456%2C123456%2C123456%2C123456%2C123456%2C123456%2C123456%2C123456
 &sparams=clen%2Cdur%2Cgir%2Cid%2Cip%2Cipbits%2Citag%2Clmt%2Cmime%2Csource%2Cupn%2Cexpire
 &signature=123456789ABCDEF123456789ABCDEFABCDEFABCD.EF1234567890ABC123123123123A1231231234123
 &upn=a1B2C3d4E5F&id=b7935aa6939a4137&gir=yes&mt=14001000000&sver=3&expire=1400200000
 &dur=791.010&source=youtube&lmt=123456789012345&itag=36&dnc=1&cpn=-ABCDEFGHIJKLMt3 HTTP/1.1
Host: r3---sn-mv-ab4a.googlevideo.com
Connection: keep-alive
User-Agent: com.google.android.youtube/5.6.36(Linux; U; Android 4.4.2; en_US; Nexus 7 Build/KOT49H)
Accept-Encoding: gzip,deflate

This was when I was watching the video: https://www.youtube.com/watch?v=t5NappOaQTc on the mobile app.

Note these two ids correspond with each other; one is the video id encoded in (modified) base64, and the other is the video id encoded in a hexadecimal. Going into python, you can show that they are identical:

>>> import base64
>>> base64.b64decode('t5NappOaQTc=').encode('hex')
'b7935aa6939a4137'

Alternatively to go the other way:

>>> base64.b64encode('b7935aa6939a4137'.decode('hex'))
't5NappOaQTc='

So it is possible for a network eavesdropper to note what videos you are watching over the youtube mobile application.

Improve this answer
0

You must log in to answer this question.