Securing mobile application communications is critical in today’s threat environment, where intercepting application sensitive data is a top target for attackers. One effective way to help safeguard client-server communications is through SSL certificate pinning.
In this blog post, we will look at SSL pinning, how it is implemented for iOS and Android and the associated risks of using this added security control.
What Is SSL Certificate Pinning?
SSL certificate pinning is a security technique that helps ensure a mobile application communicates only with trusted servers. Typically, apps rely on the certificate chain of trust to verify server authenticity. However, this standard validation trusts any certificate signed by a trusted Certificate Authority (CA). This trust can be exploited through man-in-the-middle (MITM) attacks if an attacker uses a rogue certificate.
Certificate pinning enhances this process by embedding a server certificate or public key directly into the application. During communication, the application checks the server’s certificate against the pinned value, rejecting connections to untrusted servers—even those with valid CA-signed certificates.
Why Is Certificate Pinning Important?
By adding certificate pinning to your mobile application, developers can:
- Reduce the Mobile Attack Surface: It prevents the app from trusting certificates issued by external CAs, which could be exploited by attackers.
- Mitigate MITM Attacks: Ensures secure communication and helps mitigate MITM attacks.
- Strengthen Trust: Certificate Pinning can be especially critical in industries handling sensitive data, such as finance and healthcare.
While not universally adopted, certificate pinning is gaining popularity, particularly in sectors that demand continued robust security.
Types of SSL Certificate Pinning
Certificate Pinning
The mobile application embeds a X.509 certificate during development. At runtime, it validates the server's certificate against the embedded one. While straightforward, this method requires updates to the application when the certificate expires or requires an update, unless an intermediary certificate is pinned to allow for more flexible rotation. If that is the case, as long as the same intermediary is used to generate the certificate it can save the need to require application updates with each expiry.
Public Key Pinning
Instead of embedding the entire certificate, only the server’s public key is pinned. This method is more flexible, as public keys rarely change even when certificates are rotated. However, it requires additional steps to extract and manage the public keys during implementation.
Common Implementation Methods
Certificate pinning ensures secure communication between mobile apps and servers by validating certificates directly within the application. Here are some popular implementation methods for iOS and Android platforms:
iOS
- Alamofire Certificate Pinning: Popular in Swift iOS applications, Alamofire supports pinning certificates bundled within the application.
- NSURLSession: Developers manually validate server certificates against those stored in the application bundle.
Android
- Network Security Configuration: A declarative XML approach introduced in Android 7.0 for easy pinning without modifying application code.
- OkHttp Library: Features a CertificatePinner class to implement pinning programmatically.
- TrustManager: Allows custom certificate validation logic, though it's generally more complex to implement.
By leveraging these methods, developers can ensure secure, tamper-proof communication between their mobile applications and servers. Choosing the right implementation depends on the level of customization and the security requirements of the application.
Challenges with Certificate Pinning
Certificate pinning for mobile applications of course can come with various challenges and concerns:
- Maintenance Complexity: Changes in certificates may require application updates, disrupting users if not managed properly.
- Implementation Complexity: Properly implementing and testing pinning requires specialized knowledge and careful handling, potentially increasing development effort.
- Limited Effectiveness in Isolation: Without additional controls (e.g., root detection), pinning can be circumvented fairly consistently on compromised (rooted / jailbroken) devices.
Understanding these challenges is crucial for teams considering certificate pinning. Balancing security benefits with usability and maintainability ensures a smoother implementation and user experience.
Bypassing Certificate Pinning: Common Methods
While certificate pinning adds a layer of security, it is not foolproof. Security researchers and attackers use various methods to bypass it, such as:
- Runtime Bypass: Using tools like Frida to hook and disable pinning logic at runtime.
- Custom SSL Libraries: Replacing the application’s SSL handling with a modified library that bypasses validation.
- Application Patching: Manually patching out certificate pinning implementations and re-signing the application.
Understanding these methods can greatly help developers build stronger defenses.
Best Practices for SSL Certificate Pinning
To ensure a secure and resilient implementation of SSL certificate pinning, developers should follow these best practices:
- Pin Multiple Keys: Embed backup keys to avoid service disruptions during key rotation.
- Automate Key Management: Use automation to update keys and certificates efficiently.
- Graceful Failure Handling: Ensure the app can handle pinning validation failures without breaking critical functionality. (i.e application crashing)
- Secure Pinning Logic: Use code obfuscation for Android to potentially make the certificate pinning logic harder for attackers to navigate and identify.
- Combine with Other Protections: Pair pinning with runtime protections, root detection, and tamper-proofing for comprehensive security.
- Regular Network Monitoring: Update pinning configurations as part of ongoing security maintenance.
By adhering to these best practices, development teams can implement SSL certificate pinning more effectively while maintaining usability and app resilience
Corellium & Certificate Pinning
Corellium makes mobile app testing easier for security professionals at all levels with its powerful virtualization platform and built-in tools. For testing apps with certificate pinning, Corellium’s Network Monitor lets you review backend traffic, even when pinning is implemented. Plus, every virtual device supports Frida, so you can bypass protections beyond just certificate pinning and keep your security testing on track.
Advance Your Mobile Security Research with Corellium
Experience Corellium’s groundbreaking virtualization technology for mobile devices and discover never-before-possible mobile vulnerability and threat research for iOS and Android phones. Set up a meeting today to explore how our platform can optimize mobile security research and malware analysis.
