2

I am using a mobile app that installs a fake trusted CA certificate and therefore can capture the HTTPS traffic of other apps. Most of the time, this MITM attack is successful.

However, I noticed that some apps are more secure than others, and they would refuse to connect to their servers when the MITM attack with a fake trusted CA certificate is taking place.

How do those apps detect the MITM attack? Is this happening on the client side or on the server side?

It appears that HSTS and public key pinning cannot be used to prevent MITM when the user has installed the attacker's trusted CA certificate. If so, which technology can?

|improve this question
  • 3
    You're assuming that every app uses the OS's list of CA certificates. Some apps (ex. Firefox I believe) will bundle their own list of CA certs inside the application. This is a form of public key pinning as described in @MrLlama's answer. – Mike Ounsworth Aug 16 '18 at 17:40
3

It's because some applications don't use the common HTTPS API from the SDK. Some of them implement their own libraries, and have their own keystores.

In those apps, the certificate used for the connection is usually hard-coded, or the root certificate is hard-coded. In this cases, unless you modify the application to trust your certificate, installing user or system certificates will not work.

|improve this answer
3

Public key pinning absolutely can prevent MITM even with a trusted CA certificate. The whole point of pinning is that the application knows exactly which certificate (hash, issuer, etc) to expect. Even though the trusted CA can generate a "valid" certificate for the domain, it won't be the exact certificate that the application is looking for, so it will reject it.

|improve this answer
2

HSTS and HPKP are both for browsers, not generic mobile apps. Browsers that comply with the RFC can (and do) allow a connection with a manually trusted certificate despite HPKP. Mobile apps don't need to do this though, they don't even need to use HTTP. Certificate pinning in mobile apps is a similar idea to HPKP, but it's a different implementation.

|improve this answer
1

If you are talking about Android devices, it's because in Android 7 and above, an app can choose whether to trust user-installed root certificates or not. They are just simply distrusting the cert you installed.
If you can root your device, then you will be able to install your root into the system trust store, then the app would trust it.

|improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy