Is it possible to implement secure ssl pinning implementation for without server side validation?

Question

It is known fact that in android there are couple of tools which can bypass ssl pinning such as Justtrustme, Android-SSL-TrustKiller. In iOS there are ios-SSL-Killswitch.

I had 3 options to implement ssl pinning in my application.

1. Using a simple HttpsURLConnection with a PinningTrustManager
2. Using a simple HttpClient with a PinningTrustManager
3. Working with PinningTrustManager and PinningSSLSocketFactory more directly

I tried all 3 options however it was possible to bypass these mechanism. I found that last option was bit secure compare to other two as few tools did not able to bypass but one did.

Here is my pseudo code example for pinning.

           // Get an instance of the Bouncy Castle KeyStore format
           KeyStore trusted = KeyStore.getInstance("BKS");
           // Get the raw resource, which contains the keystore with
           // your trusted certificates (root and any intermediate certs)
           InputStream   in = getResources().openRawResource(R.raw.key);
           try {
               // Initialize the keystore with the provided trusted certificates
               // Provide the password of the keystore
               trusted.load(in, KEYSTORE_PASSWORD);
           } finally {
               in.close();
           }

           String tmfAlgorithm = TrustManagerFactory.getDefaultAlgorithm();
           TrustManagerFactory tmf = TrustManagerFactory.getInstance(tmfAlgorithm);
           tmf.init(trusted);

Is there any secure solution of at least the best available solution for implementation?

Answer 1

No, there is no secure solution. All the mentioned tools that bypass SSL certificate pinning depending on root access.

If the phone is rooted/jailbroken there is no way for an app to enforce anything. As your application is only a piece of software running on that system, the person who owns the system (and that is the user on jailbroken/rooted devices) can always bypass your security mechanisms. The only thing you can do is to make the live of the person who wants to disable SSL certificate pinning harder. One way is to use a jailbreak/root detection and block jailbroken/rooted devices.