  Recent studies have shown that a significant number of mobile applications,
often handling sensitive data such as bank accounts and login credentials,
suffers from SSL vulnerabilities. Most of the time, these vulnerabilities are
due to improper use of the SSL protocol (in particular, in its \emph{handshake}
phase), resulting in applications exposed to man-in-the-middle attacks. In this
paper, we present MITHYS, a system able to: (i) detect applications vulnerable
to man-in-the-middle attacks, and (ii) protect them against these attacks. We
demonstrate the feasibility of our proposal by means of a prototype
implementation in Android, named MITHYSApp. A thorough set of experiments
assesses the validity of our solution in detecting and protecting mobile
applications from man-in-the-middle attacks, without introducing significant
overheads. Finally, MITHYSApp does not require any special permissions nor OS
modifications, as it operates at the application level. These features make
MITHYSApp immediately deployable on a large user base.
