4

I am familiar with the basics of CT and certificate pinning. However, I'm failing to understand how CT properly replaces pinning in mobile apps in a scenario in which, for example, an attacker steals a device or downloads the application from the app store, installs a trusted certificate belonging to a common proxy such as BurpSuite or mitmproxy, and attempts to intercept traffic in order to gain additional information about the app's API. I know proper cert pinning implementations will automatically prevent those connects. On the other hand, will certificate transparency prevent this? If so, how does it do it? I've analyzed apps in which the proxied traffic contains the Expect-CT header, yet I'm able to intercept the traffic with no issues. This is where my confusion comes from.

Thanks in advance.

2 Answers 2

3

Certificate Transparency (CT) and Certificate Pinning are different things for different purposes.

Certificate Pinning is intended for an application to not let any non-pinned certificate to be used, no matter its origin. Certificate Transparency is a mechanism for auditing all certificates issued by a Certificate Authority to make sure no CA issues any certificate it does not have the rights to issue.

CT is not used on the application. It's used outside of the application, more on the management layer. It allows any entity to quickly identify any certificate issued for them when they didn't asked for a new certificate. So in the case any fraudulent or incorrect issued certificate is listed, it can be revoked very fast.

Certificate Pining is used on the application. It makes more difficult for a reverse engineer to intercept and analyse traffic because he will need to bypass the pining (either by replacing the pinned certificate on the application, or patching the pin check function). It will not make traffic impossible to analyse, but will make it more difficult.

4

will certificate transparency prevent this?

No, it won't. Certificate Transparency is designed to catch CAs that issue malicious certificates. However, in your scenario, no malicious certificate has been issued. The user has just manually trusted their own certificate. Therefore, certificate transparency will do nothing here.

As a side note, even certificate pinning alone will not significantly hinder a skilled and determined reverse-engineer.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .