保护检查SSL证书的连接安全吗？

Question

I'm doing an internships. Here they give me a code of an Android application that have been revisione by an agency for the code security and told me to change some points present in a document. Now they fear for the information leakage because the application doesn't check for the SSL certificates when connecting to the bank server, risking a "Man In The Middle" attack.

Is there any class that i can use to check expirency date of the cert. or if it is trusted?

An example of a http connection in the app:

           trustStore = KeyStore.getInstance(KeyStore.getDefaultType());
            trustStore.load(null, null);
            SSLSocketFactory sf = new CustomSSLSocketFactory(trustStore);
            sf.setHostnameVerifier(SSLSocketFactory.ALLOW_ALL_HOSTNAME_VERIFIER);
            HttpParams bhttpparams = new BasicHttpParams();
            HttpProtocolParams.setVersion(bhttpparams, HttpVersion.HTTP_1_1);
            HttpProtocolParams.setContentCharset(bhttpparams, "utf-8");
            bhttpparams.setBooleanParameter("http.protocol.expect-continue", false);
            HttpConnectionParams.setConnectionTimeout(bhttpparams, 20000);
            HttpConnectionParams.setSoTimeout(bhttpparams, 200000);
            SchemeRegistry registry = new SchemeRegistry();
            registry.register(new Scheme("http", PlainSocketFactory.getSocketFactory(), 80));
            registry.register(new Scheme("https", sf, 443));
            ClientConnectionManager ccm = new ThreadSafeClientConnManager(bhttpparams, registry);
            client = new DefaultHttpClient(ccm, bhttpparams);
            client.getCredentialsProvider().setCredentials(new AuthScope(null, -1), new UsernamePasswordCredentials("", ""));
            HttpResponse response = client.execute(urlws);
            in = new BufferedReader(new InputStreamReader(response.getEntity().getContent(), "UTF-8"), 8);

Answer 1

sf.setHostnameVerifier(SSLSocketFactory.ALLOW_ALL_HOSTNAME_VERIFIER);

The vulnerability is here. Remove it.

But I would question both the competence and the sanity of anyone who gave this task to an uninformed intern without a proper briefing, and you can tell them I said so. I would also be asking some severe questions about how this line of code ever got there in the first peace, and about the inadequacy of the testing that allowed it to remain.