6

I used SSL Kill Switch on some iOS mobile applications to try to bypass certificate pinning and I was successful. I understand that SSL Kill Switch "kills" the certificate validation process on the clients side and this is how it works. However is there any way that developers could somehow prevent this from happening? Is this an indication that the certificate pinning wasn't successfully configured?

Improve this question
1
  • You need to think about threat models, instead of random ideas. What is the threat model here?
    – Neil McGuigan
    May 3, 2016 at 17:32

2 Answers 2

Reset to default
3

From the github readme for the iOS SSL Kill Switch project:

Once installed on a jailbroken device, iOS SSL Kill Switch patches low-level SSL functions within the Secure Transport API

So your question basically boils down to: "How do I prevent my app from being infected with malware on a rooted / jailbroken device?". In short: you don't. This is why you don't root your device!

There are obfuscation tricks you can do to make this harder; for example write your own in-house SSL / TLS library (terrible, horrible idea, don't do this!), and then include this crypto in your compiled program so that there's no dependency on the OS's crypto libraries. Now you're immune to a hack in the OS's crypto layer, but if the attacker is targeting your app specifically then there's nothing to stop them, so you're not preventing an attack like this, just making it more difficult.

Another trick I've heard of is for the app to try to detect if it's running on a rooted device, and refuse to run if it is. That said, if you google "bypass jailbreak detection" you'll see that there is a constant game of whack-a-mole going on between hackers and developers where the hackers are getting increasingly clever at hiding the jailbreak. I don't recommend playing this game.

Improve this answer
2

There is no point in trying to prevent this. Technically I guess you could slow down an attacker by implementing your own crypto (SSL Kill Switch modifies the OS-provided crypto functions) but even that will eventually get cracked given enough time and effort.

If you don't control the hardware, your software has no chances. Just live with it and let people do whatever they want on their device.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .