1

I am using Burp as a proxy to test an Android app. To get this to work I installed the Burp CA certificate on my phone. As far as I understand it (and that is not a lot of understanding) I could leave this certificate on my phone without adding a large security risk, as the CA certificate is created by Burp for the specific instance/device.

But I am not sure about this, so the question is: What security risks am I introducing to my personal phone when leaving the Burp CA certificate installed instead of deleting it after testing? And why?

Improve this question

2 Answers 2

Reset to default
2

You're correct to say that there is unlikely to be a large increase in risk, so long as you keep control of the CA key that is.

Basically if someone got control of the CA key used by burp, they would be able to carry out a MITM attack on your phone as it would see certificates issued by that CA as valid.

However, as you say, the key is unique to each installation of burp, so as long as you don't lose the key in question, then an attacker won't be able to misuse it.

Improve this answer
0
0

You have nothing to worry about. The first time you run mitmproxy it will generate a unique key for the CA. This means that no one else will be able to generate the same key and resign keys from the CA that was created for you.

See the following link for reference. http://docs.mitmproxy.org/en/stable/certinstall.html#the-mitmproxy-certificate-authority

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .