Though it is commonly known as SSL pinning, current implementations depend on the successor to SSL, which is Transport Layer Security (TLS). By using this approach, the risk of encountering fake certificates and falling prey to an MiTM attack is greatly reduced. Read on to know how SSL Pinning enables Man in the Middle attack prevention.
What is SSL Pinning?
SSL pinning enhances HTTPS security by linking a mobile app directly to a designated server certificate or public key. Rather than relying on the broad trust of any Certificate Authority (CA), the app cross-references the server's identity against a specific, hardcoded certificate or key stored within its own code. This mechanism restricts the application to communicating exclusively with authorized backend servers.
What is MiTM Attack?
A Man-in-the-Middle (MiTM) attack happens when a digital eavesdropper secretly inserts themselves into a conversation between two entities; where typically, these entities are the user and a server. By positioning themselves in the middle, the fraudster can intercept, read, or even modify the data being sent back and forth without either party realizing the connection has been compromised.
Digital Certificates and Their Limitations in Mobile App Security
Digital certificates, or public key certificates, authenticate servers and contain the public keys utilized to form encrypted TLS connections. They operate within the public key infrastructure (PKI) to make sure that the transferred data between two systems (whether it is between a server and a device or between two servers) is both authenticated and encrypted.
Certificate validation depends on the OS’s trusted certificate store. Since the store contains plenty of trusted certificate authorities, malicious actors may exploit the extensibility of the store and install a harmful root certificate on the device. In MITM iOS and Android MITM situations, this is where SSL addresses the gaps.
How SSL Pinning Protects Mobile Apps from MITM Attacks
With SSL pinning, applications are developed to accept a designated TLS (Transport Layer Security)/SSL certificate for a host or host group. Instead of accepting any legitimate certificate that the server provides, which could possibly be from a malicious source, the app is engineered to acknowledge and validate only the predetermined, exact certificate or public key. This stops the application from being deceived into admitting fraudulent certificates, which could be used in MITM attacks.
For mobile apps, pinning usually takes place within the application code. With SSL pinning in Android, even if a malicious actor deceives a user into installing a malicious root certificate, the app remains secure by looking for only a predefined, specific pin.
How Malicious Actors Bypass Pinning
These are the common techniques that threat actors use to evade SSL pinning.
1. Forging a Certificate: Threat actors may install a harmful root certificate on a device and employ interception tools to produce certificates for target domains, enabling them to intercept TLS traffic.
2. Recompiling after Decompiling: Attackers decompile the app to examine the code, discover the pinning logic, and change it to make it bypass the SSL pinning checks. The altered application is then recompiled and released, facilitating interception and manipulation of data in transit for attackers.
3. Modifying App Behaviour at Runtime: Attackers use tools to change the behaviour of the app at runtime. They use tools such as Xposed Framework (and its modern successor LSPosed) or Frida to hook into the application’s pinning implementation, thus disabling it or making the application accept any certificate.
4. Rooted Devices and Custom ROMs: On devices running custom read-only memory (ROMs) or rooted devices, malicious actors have deeper control over the OS, giving way for easy hooking or modifying app behaviour to bypass pinning checks.
Static vs Dynamic SSL Pinning
These are the two types of advanced SSL pinning, which are harder to bypass:
1. Static Pinning: This type of pinning involves embedding the public key or certificate of the server within the application code. It is a straightforward method, but app updates are necessary whenever the certificate of the server is renewed.
2. Dynamic Pinning: Dynamic pinning includes obtaining the anticipated public key or certificate from a secure server during runtime. This technique provides more flexibility but needs robust fallback mechanisms and secure initial communication.
SSL Pinning in Android
You can implement SSL pinning in Android using two main methods:
1. NSC (Network Security Configuration): This approach is the recommended, modern one for applications aimed at Android 7.0 (API level: 24) and higher, since it allows defining security policies in an XML file without changing the Kotlin/Java code.
2. Programmatic Techniques: Solving tasks through active coding is necessary for apps that need to support the versions of Android below 7.0 or the apps that require dynamic pinning behaviour.
SSL Pinning in iOS
There are two approaches to pinning in iOS:
1. Certificate Pinning: Here, pinning the whole SSL certificate of the server in your application takes place. It is secure, but you need to update your application (typically annually) whenever the SSL certificate expires.
2. Public Key Pinning: This slightly more complicated approach involves pinning just the public key from the certificate of your server. This method is more flexible since you can rotate certificates without having to update the app if you hold the same key pair.
Why SSL Pinning Is Important for Mobile App Security
By limiting which server certificates an app can trust, SSL pinning helps prevent interception and Man-in-the-Middle (MITM) attacks. Here’s why it is crucial from a Mobile App Security standpoint.
1. Defense Against MITM Attacks: MITM attacks take place when an attacker interrupts and probably alters the ‘user-to-server’ communication. With SSL pinning, mobile applications can make sure they are communicating with the correct server, preventing malicious actors from tampering with or intercepting the data in transit.
2. User Confidence and Trust: Users expect complete protection of their financial and personal information. By using strict security measures, such as SSL pinning, developers can gain the trust of their users. This increase in user confidence leads to higher retention rates.
3. Intensified Data Security: For mobile applications involving sensitive data, such as health apps, banking apps, or any other apps that need user authentication, SSL pinning provides an additional layer of security. Pinning makes sure that data transferred between the server and the app remains intact and confidential, protecting the information of users from potential breaches.
4. Security Standards Compliance: While not mandatory by most regulations, pinning can strengthen the overall security system of an organization and support the organization’s compliance efforts.