Description

Detects the use of insecure socket connections in Android applications that could expose sensitive data to network-based attacks. This vulnerability occurs when an app creates plain socket connections without encryption, potentially allowing attackers to intercept or manipulate network traffic.

Detection Strategy

• Identifies direct Socket or ServerSocket instantiations without SSL/TLS encryption

• Detects socket connections that don't use secure protocols (like using port 80 instead of 443)

• Flags socket connections created without security configurations or encryption wrappers

• Reports vulnerability when network connections bypass Android's secure networking defaults