2

To prevent MITM from my app I will use cert pinning.

To prevent having not approved parties communicate to my server I can use Mutal TLS, which actually accepting communication from trusted sources.

Am I am missing something or it sounds the same?

4
  • 1
    If you are worried that the client can fall in malicious hands, take into account that you app can be instrumented such that the certificate is still valid, but the payload is manipulated and/or stolen. Your app needs other protections, like root and injection detection, keeping all data encrypted, etc. – Alex Cohn Oct 19 '19 at 12:17
  • Can a malicious application installed on a jailbroken device do MITM on any other application while it's running? – Filipon Oct 19 '19 at 13:39
  • 1
    I am speaking about a jailbroken device. For Android, rooting is legitimate. – Alex Cohn Oct 19 '19 at 13:40
  • me too, I think we both on the same thought – Filipon Oct 20 '19 at 16:22
4

While mutual TLS and certificate pinning are intended for different problems they can be used to solve the specific problem of detecting active MITM too. Only, with mutual TLS it is the server which detects the MITM (client certificate not as expected) while with certificate pinning it is the client (server certificate not as expected).

Implementation requirements are different too:
In case of (server) certificate pinning the clients needs the certificate of the server (or the CA in case of CA pinning). A fingerprint (hash) of the certificate or the public key (more flexible) would be sufficient too. And all clients can share the same information regarding the servers certificate.
With client certificates though each client needs a certificate and the matching private key. Each client should also better have a different certificate with a different key since sharing the same private key between clients makes it way more likely that an attacker gets access to the key. And of course proper revocation and a process to reissue a certificate needs to be installed in case the key from one client is compromised. This makes it way more complex and less scalable than server certificate pinning.

In other words: while both server certificate pinning and client certificates could be used to detect active MITM the use of server certificates is much simpler and scales better. Thus just using client certificates to detect MITM is probably a bad idea, but if they are needed anyway the side effect of protecting against active MITM can be used.

2
  • In both cases the mobile app will be required to have a cert (client cert + server cert), right? – Filipon Oct 19 '19 at 3:10
  • 1
    @Filopn: I've extended the answer to make it more clear what the actual requirements are on the client and server side and what is the preferred way to solve the problem of detecting MITM. – Steffen Ullrich Oct 19 '19 at 6:42
1

If you are worried that the client can fall in malicious hands, take into account that you app can be instrumented such that the certificate is still valid, but the payload is manipulated and/or stolen.

Consider two distinct scenarios:

  1. To instrument your app such that the certificate for mutual TLS is still valid, but the data is manipulated and/or stolen, the attacker does not need a rooted device. This involves changing the APK and installing this changed APK. This could be an end user who consciously runs a forged app, or someone who is persuaded to install such app. We can try to employ various obfuscation techniques to make such attack harder, but there is no way we can offer full protection against a determined and skillful hacker.

  2. On a jailbroken device, a malicious app can take over your traffic and effectively perform a MITM attack without changing your app, and reusing (abusing) the valid client certificate. Such attack can happen even if the device is jailbroken unbeknownst to the owner. In this situation, some other protections, like root and injection detection, keeping all data encrypted, etc. may be useful to mitigate or deter the attack.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.