I am using a mobile app that installs a fake trusted CA certificate and therefore can capture the HTTPS traffic of other apps. Most of the time, this MITM attack is successful.
However, I noticed that some apps are more secure than others, and they would refuse to connect to their servers when the MITM attack with a fake trusted CA certificate is taking place.
How do those apps detect the MITM attack? Is this happening on the client side or on the server side?
It appears that HSTS and public key pinning cannot be used to prevent MITM when the user has installed the attacker's trusted CA certificate. If so, which technology can?