1

It is known fact that in android there are couple of tools which can bypass ssl pinning such as Justtrustme, Android-SSL-TrustKiller. In iOS there are ios-SSL-Killswitch.

I had 3 options to implement ssl pinning in my application.

  1. Using a simple HttpsURLConnection with a PinningTrustManager
  2. Using a simple HttpClient with a PinningTrustManager
  3. Working with PinningTrustManager and PinningSSLSocketFactory more directly

I tried all 3 options however it was possible to bypass these mechanism. I found that last option was bit secure compare to other two as few tools did not able to bypass but one did.

Here is my pseudo code example for pinning.

           // Get an instance of the Bouncy Castle KeyStore format
           KeyStore trusted = KeyStore.getInstance("BKS");
           // Get the raw resource, which contains the keystore with
           // your trusted certificates (root and any intermediate certs)
           InputStream   in = getResources().openRawResource(R.raw.key);
           try {
               // Initialize the keystore with the provided trusted certificates
               // Provide the password of the keystore
               trusted.load(in, KEYSTORE_PASSWORD);
           } finally {
               in.close();
           }

           String tmfAlgorithm = TrustManagerFactory.getDefaultAlgorithm();
           TrustManagerFactory tmf = TrustManagerFactory.getInstance(tmfAlgorithm);
           tmf.init(trusted);

Is there any secure solution of at least the best available solution for implementation?

5

No, there is no secure solution. All the mentioned tools that bypass SSL certificate pinning depending on root access.

If the phone is rooted/jailbroken there is no way for an app to enforce anything. As your application is only a piece of software running on that system, the person who owns the system (and that is the user on jailbroken/rooted devices) can always bypass your security mechanisms. The only thing you can do is to make the live of the person who wants to disable SSL certificate pinning harder. One way is to use a jailbreak/root detection and block jailbroken/rooted devices.

  • We thought of this process however, if we disable application for rooted/jailbroken device, then it affects on our trade turnover. That is why I was seeking for some other solution. – FrOgY Sep 8 '16 at 11:35

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.