0

I have doubt. For android application security which SSL pinning method is good?

  1. Deploying HTTP Public key pinning
  2. Deploying certificate validation using *.bks format along with hostname verifier.

Second one is recommended more for Critical Infrastructure such as Military according to some experts.

In HTTPPubliKeyPinning there is an advantage that I can give an array of numerous public key. So that if one of my certificate gets expires, app will automatically switch public key of other certificate on other domain.

Where in BKS, developer need to append new certificate in APK and have to give client using force update else application will not work.

However, exploit ability metrics has the same time frame. I can exploit flaw 1 as well as flaw 2 using Xposed framework using JustTrustMe application within it. It will require same amount of time and effort. Also in both scenario if hacker successfully repackages application using 1. our public key or using 2. certificate after reverse engineer, he/she will be able to bypass these restrictions. Any other benefit of using second method?. Is there any good method available than this?

So with the accordance of business continuity and security which one is best?

1

I think you are expecting a protection from certificate pinning which it can not offer. This means that the actual technique used for pinning does not matter at all in your case. Certificate pinning only changes how the certificate gets validated by checking if the public key of the certificate matches the expectation. This check is done either additionally to the normal validation or replaces it.

Certificate pinning does not make your app magically secure against reverse engineering, tampering or shipping of a modified version. It makes it a bit harder for some reverse engineer to sniff and modify the transferred data since one cannot simply add another trusted CA to the trust store in order to trust a man in the middle. But it is still possible to bypass the certificate validation by ripping it out of your application or changing it. Or a reverse engineer could grab the data from your application before they get encrypted and after decryption while keeping the validation in place.

In general TLS does not protect against modifications of client or server. It only protects the transport between client and server against a passive or active attacker trying in between client and server to sniff or modify the traffic. And certificate pinning only hardens this part.

  • I am aware about certificate pinning and why it is used. I want to protect my application traffic which can be intercepted via burpsuite. There are different methods of SSL Pinning implementation out of which I have explained 2 with its flaw and advantages. Now I want to know which one is secure enough at some extend in order to make it hard for an attacker to intercept traffic by bypassing ssl pinning implementation. – FrOgY Nov 16 '16 at 4:11
  • @FrOgY: all kinds of SSL pinning make it impossible for a man in the middle to intercept the connection even if he got a usually trusted certificate. But once the attacker has full access to the clients device and/or can modify the client application even SSL pinning does not offer protection anymore. Since you are assuming that kind of access in your question the answer is that none of the proposed methods is secure enough. – Steffen Ullrich Nov 16 '16 at 5:20

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.