CVE-2017-9598 in Mobile Banking App
Summary
by MITRE
The "Morton Credit Union Mobile Banking" by Morton Credit Union app 3.0.1 -- aka morton-credit-union-mobile-banking/id1119623070 for iOS does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 10/18/2019
The CVE-2017-9598 vulnerability affects the Morton Credit Union Mobile Banking iOS application version 3.0.1, representing a critical security flaw in the mobile banking ecosystem. This vulnerability stems from the application's improper implementation of SSL/TLS certificate validation mechanisms, specifically the absence of X.509 certificate verification during secure communications. The flaw exists within the application's cryptographic implementation and represents a failure in secure communication protocols that should be fundamental to financial mobile applications. The vulnerability is categorized under CWE-295 which specifically addresses "Improper Certificate Validation" and aligns with ATT&CK technique T1046 for network service scanning and T1566 for credential access through phishing or man-in-the-middle attacks.
The technical implementation flaw manifests when the mobile banking application establishes secure connections to backend servers without properly validating the SSL certificates presented by those servers. This allows attackers to perform man-in-the-middle attacks by presenting fraudulent certificates that appear legitimate to the vulnerable application. The certificate verification process is entirely bypassed, enabling attackers to intercept, modify, or redirect communication between the mobile client and the financial institution's servers. This vulnerability specifically targets the trust model implementation where the application fails to validate certificate chains, check certificate expiration dates, or verify certificate signatures against trusted certificate authorities. The absence of proper certificate pinning or validation creates an exploitable condition that undermines the entire security architecture of the mobile banking platform.
The operational impact of this vulnerability is severe for both end users and the financial institution. Mobile banking users face significant risk of credential theft, financial transaction manipulation, and unauthorized account access when conducting banking activities through the vulnerable application. Attackers can exploit this flaw to capture sensitive information including login credentials, account numbers, transaction details, and personal identification information. The vulnerability is particularly dangerous because it affects a mobile banking application where users typically conduct high-value transactions and maintain sensitive financial data. Financial institutions face reputational damage, regulatory compliance violations, potential legal liability, and increased risk of large-scale fraud incidents. The vulnerability also exposes the institution to potential regulatory penalties under financial services compliance frameworks such as those enforced by the federal banking regulators and payment card industry standards.
Mitigation strategies for this vulnerability should include immediate implementation of proper SSL certificate validation mechanisms within the mobile application. The application must be updated to perform comprehensive X.509 certificate validation including certificate chain verification, expiration date checking, and signature validation against trusted certificate authorities. Implementing certificate pinning techniques would provide additional protection against certificate spoofing attacks. Regular security audits and penetration testing should be conducted to ensure proper cryptographic implementation. The application should also implement proper error handling for certificate validation failures and establish secure communication protocols that cannot be bypassed. Organizations should consider implementing additional security controls such as mutual authentication, secure key management, and regular security updates to prevent similar vulnerabilities in future releases. The remediation process should follow established security frameworks including NIST SP 800-52 for certificate management and OWASP Mobile Security Project guidelines for secure mobile application development.