0

My goal is to prevent man-in-the-middle (MITM) attacks through proxies. I've implemented SSL pinning, which has helped significantly, but I'm wondering if there's anything more I can do that's worth the time in securing my connection? What can a user do to get around SSL pinning? Is there anything I can do to further prevent MITM attacks if the attacker gets around SSL pinning?

Right now, we're concerned with an attacker getting around pinning and using a proxy to be able to open the html page (by getting its URL from the proxy) in a device browser (like Chrome) outside of the app.

  • Can you give more details about your use-case? Are you trying to secure yourself against generic MitM attacks (in which case SSL Pinning might be a bad idea), or are you building a website and are trying to protect your users against MitM attacks? – Conor Mancone Jan 16 at 16:29
  • If you are talking about securing the communication of your own website/app, what is the client? Web browser, phone app, desktop application? – Conor Mancone Jan 16 at 16:29
  • @ConorMancone I'm running a local (127.0.0.1) web server on the Android device and connecting to it through WebViews. I've enabled HTTPS and SSL pinning to do what I can do secure that connection. – user9841123 Jan 16 at 16:31
  • What is your threat model? ie are you trying to protect against an attacker who can only control network traffic outside of the device? Or against the user who owns the app? Against a user who is allowed to modify the app? Against a user of a rooted android device? – Mike Ounsworth Jan 16 at 17:11
  • Right now, we're concerned with an attacker getting around pinning and using a proxy to be able to open the html page (by getting its URL from the proxy) in a device browser (like Chrome) outside of the app. – user9841123 Jan 16 at 17:19
2

Right now, we're concerned with an attacker getting around pinning and using a proxy to be able to open the html page (by getting its URL from the proxy) in a device browser (like Chrome) outside of the app

Pinning is to ensure in the client that it connects to the right server. But it looks like that this is not your actual problem. Instead you are trying to ensure that the expected client connects to the server. In this case you obviously need to authenticate the client - client side pinning only authenticates the server to the client.

To authenticate a client to the server client certificates can be used which then of course need to be properly checked by the server. Note that it might still be possible to extract the certificate and use it outside the application. This again might be prevented by hardware backed certificates, i.e. certificate on a smartcard or similar.

Note that all of this does not help to protect the manipulation by an attacker which has full access to the device, i.e. you cannot use this to hinder the owner of a device to reverse engineer and use the application in a way which was not intended by you.

1

What you want is something very hard to achieve. Just ask most massive online multiplayer games about unnoficial clients.

If the attacker can run the client on a device he controls, he can change the client's code to do whatever he wants. He can learn the protocol you use, and create another client implementing the protocol. SSL will not protect you, as he can export any certificate and use it elsewhere.

As Steffen pointed out, storing the certificate inside a cryptographic secure storage (HSM, or TrustZone, or equivalent) is one way to mitigate this attack in some cases. If the attacker can install the client by itself, he can install it on an emulated device with an emulated security enclave, and extract the keys.

On your specific case, it's yet more difficult, as the attacker will have both the client AND the server on a device he controls.

Not the answer you're looking for? Browse other questions tagged or ask your own question.