Saturday, 2 February 2013

Mobile Client Side Certificate Pinning


I just completed giving a training on Secure Mobile application development and Code reviews and one of the attendees asked me query whether we can limit a Mobile application to allow only the servers certificate to be a trusted one rather than relying on the Mobile's own Trusted Certificate Store?

Well... there is a way actually. Its called as "Certificate Pinning". Rather than relying on the device trusted store, set the application to trust only the servers SSL certificate. This way, when you are connecting to your specific SSL server, you don’t need anyone else to tell you the server’s identity. Compromises of any of the CA in the device trusted store too does not matter as the connection does not rely on it any more. 

There are ways to implement it on both Android and iOS. Twitter for example; implements certificate pinning and i was not able to intercept traffic even after forcing my certificate on to the OS level trusted certificate list.

Good Reads:

Certificate Pinning on iOS:

Certificate Pinning in Android:

Way to achieve this can be seen here, which is a OWASP page explaining the various details on Certificate Pinning.

However, like all other good things, this too can be bypassed :D .. This link will tell you how you can bypass it on iOS using Mobile Substrate and on Android using JDWP.

Understandably this would not be of much use against remote attacks but atleast would help in cases where attacker tries to fuzz for local vulnebilities in the application right? 

I wonder why none of the other applications are not using it and whether there would be any drawback of suggesting it to the client. 
Open for discussion :)

26 comments:

  1. Nice comment!!!!
    Android is very useful in present time.there are many mobiles are working in android ...
    Android Training Certificate

    ReplyDelete
  2. Thanks for sharing your info. I really appreciate your efforts and I will be waiting for your further write
    Signature:
    i like play games friv online and play games2girls Download baixar facebook

    ReplyDelete
  3. nice blogs.
    Friend chatMake new friend’s without revealing yourself. Dial 543216 at Rs 2/min and monthly subscription of Rs 30/ 30 days.

    ReplyDelete
  4. Thank you very much for your post, it makes us have more and more discs in our life, So kind for you, I also hope you will make more and more excellent post and let’s more and more talk, thank you very much, dear.
    happy wheels
    super mario bros
    pacman
    agario

    ReplyDelete
  5. Thanks for sharing the information. It is very useful for my future. keep sharing
    Kizi 123|
    Friv 234|
    Friv

    ReplyDelete
  6. You need to kill time, you need entertainment. Refer to our website. hope you get the most comfort.
    Thanks you for sharing!
    Yepi
    Kizi
    Friv
    Friv Games

    ReplyDelete
  7. You are stressed and tired, you need entertainment. Refer to our website. hope you get the most comfortable.
    Kizi 4

    ReplyDelete
  8. you'd have time to look these kids active. Please visit our website and let us play the game interesting.
    Thanks for sharing !
    Friv 10
    Kizi 10
    Yepi 2

    ReplyDelete
  9. This is something special! never seen this before! thank you
    Friv 100

    ReplyDelete
  10. You need to kill time, you need entertainment. Refer to our website. hope you get the most comfort.
    Thanks for sharing !
    Friv 5
    Kizi 1
    Yepi 3

    ReplyDelete
  11. thank you for your interest in welcome visit
    Friv 4

    ReplyDelete
  12. New attractive game . I will play it every day
    Friv|
    Friv 2

    ReplyDelete
  13. When you're tired, you want to relax after a stressful working hours, you need to have time to take care of the kids active.
    Please visit our website and play exciting flash games.
    Thanks you for sharing!
    Friv 4

    ReplyDelete
  14. You want to relax after a stressful working hours. Refer to our website. hope you get the most comfort.
    Thanks for sharing !
    Friv 100
    Friv 8
    Friv 2

    ReplyDelete
  15. You want to relax after a stressful working hours. Refer to our website. Hope you get the most comfort.
    Thanks for sharing !
    GirlsGoGames
    Kizi 100
    Frvi

    ReplyDelete
  16. شركة زهرة العلا للخرمات المنزلية بالسعودية واحدة من افضل الشركات التي تعمل بالمجال يرجع كل هذا الي الثقة والسرعة والدقة وجودة الخدمة التي تقدم للعميل ولافضل الاسعار الممكنة مع الحفاظ علي الجودة ونوعية المبيدات ومواد النظافة واثرها علي البيئة وصحة الاسرة كما ان الموارد البشرية الخاصة بنا علي اعلي دراية وفهم بالامور وذو خبرات طويلة في مكافحة الحشرات,النظافة العامة مثل الفلل,الشقق,الواجهات الزجاجية والحجرية,البلاط والرخام,الحدائق,المسابح وغيرها من امور النظافة كما انهم يجيدون التعامل مع كافة الاثاث الخشبي والزجاجي وغيرها والقيام باعمال النقل والفك والتركيب والتغليف بواسطة النجارين المحترفين كما يوجد لدينا افخك مستودعات تخزين الاثاث بالرياض والمتميز بالصفات القياسية للحفاظ علي العفش من الاتربة والرطوبة وغيرها من الامور التي تؤدي الي التلف فقط للحصول علي الخدمات المنفردة اتصل بنا علي الارقام الموضحة بالموقع ليصلك مندوبنا للمعاينة المجانية واعطاء النصائح والارشادات افضل شركة تسليك مجاري بالدمام
    افضل شركة تسليك مجاري بالرياض
    افضل شركة كشف تسربات المياه
    افضل شركة كشف تسربات المياه بجدة
    شركة عزل اسطح الشينكو بالدمام
    ارقام الي يشترون الاثاث المستعمل بالرياض
    افضل شركة نقل عفش بالرياض
    افضل شركة نقل عفش بجدة

    ReplyDelete
  17. You need to have time to take care of the kids active. Please visit our website and play exciting flash games.
    Thanks you for sharing!
    Games2Girls
    Kizi 1000
    Frin
    Friv 3

    ReplyDelete
  18. I was working and suddenly I visits your site frequently and recommended it to me to read also. Age Of War 2
    Big Farm | Slitherio
    Tank Trouble | Happy Wheels
    Goodgeme Empire | Slither.io

    ReplyDelete
  19. This is the selected site free games and play great. Same goes for your play.
    gum mayhem
    tank trouble 2
    learn to fly 2
    can your pet 2
    happy wheels game

    ReplyDelete
  20. You want to relax after a stressful working hours. Refer to our website. Hope you get the most comfort.
    Thanks for sharing !Y8 arcade

    ReplyDelete
  21. Thank you for visiting our site. Sure you will feel is amazing. Since we have been very selective as many games and you can play online for free
    gun mayhem 3 | tank trouble 3
    learn to fly 3 | happywheels
    tank trouble

    ReplyDelete
  22. I’m glad you enjoyed it. Those are great habits! Thank you for sharing.
    Friv 100

    ReplyDelete
  23. There are things lost and I feel sorry that I did not appreciate. But there are also new things and I lost relieved realized: Yeahhhhh, and I stress, yet
    Friv Games
    Y2
    Friv 200

    ReplyDelete
  24. Work anybody but take some time to relax every day work efficiency will be higher than that. Invite you to visit our website

    Friv 1
    GirlsGoGames
    Friv 4 School

    ReplyDelete