1

An Android application that has SSL Pinning was successfully tested on a mobile device running Android 6 (with the certificates installed) using Burp proxy and OWASP ZAP Proxy. As expected the application refused connections when using either proxy.

However, when tested using Charles Proxy it was possible to intercept and read most of the app traffic in clear text, despite the presence of SSL Pinning.

What could be a reason for this? Google searches yielded no fruit.

Improve this question
6
  • What do you mean with "most" of the app traffic. Was this part even encrypted? If the proxy does not even attempt to intercept the SSL then the connection will work but the proxy will still be able to see the plain HTTP traffic which might be done by your application. – Steffen Ullrich Feb 18 '20 at 11:12
  • @SteffenUllrich All the traffic from the application is in HTTPS including the intercepted traffic. Some of the requests could not be read as the requests were dropped in the proxy for some reason, hence why I said most. Presumably this is due to the pinning in effect but that does not account as to why the rest of the requests can be intercepted and read successfully. – Wolfy Feb 18 '20 at 11:22
  • I think this question is currently too generic and provides too few details. You say that some stuff is dropped for an unspecific "some reason" and some stuff got successfully intercepted - then please explain what the difference between these connections is (maybe different target, some with pinning, others without?). Please describe what "most of the app traffic" is which was successfully intercept and what the other traffic is. – Steffen Ullrich Feb 18 '20 at 12:16
  • @SteffenUllrich all the traffic that was either dropped or intercepted were directed at the same domain. In theory this domain is what the SSL pinning is implemented for. Burp and ZAP did not intercept any requests and the app gave an SSL error, as it should when pinning is present. I am not sure why Charles proxy was able to intercept and view in clear text some of the requests sent to the domain and why some of the requests failed, again to the same domain that pinning is implemented on. – Wolfy Feb 19 '20 at 3:27
  • If the proxy is able to intercept and decrypt the requests with its own CA which is not trusted by the app (at least this is what I read out of your information) then pinning is obviously not working. For details on why this happens one would probably need access to a setup where one can reproduce the issue. – Steffen Ullrich Feb 19 '20 at 5:48

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.