I'm gonna be writing an app that connects to a server with sensitive information and one of the main requirements is that only my app will be able to make the connection. There is no user supplied username or password involved. Btw, this will be on the Android platform, but that shouldn't be too relevant for this question.
I'm not too familiar with the inner workings of secure internet communications, however, I'm assuming the best approach will be to establish a SSL connection between my app and the server. The concern I have is: what prevents someone from monitoring what network traffic my app sends to the server to initiate the SSL connection and then sending the same traffic to open up their own connection (ie: duplicate the random number I send to the server that's used to create the session key)? I'm assuming these kind of things have been though of before and secured against, but I'm hoping someone can share some more insight into this to help deal with my concern.