2

I'm a pentester and this is my first question here. I've managed to circumvent the ssl certificate pinning implementation on a few mobile apps.

Frankly, the applications I test are critical bank applications and I can listen to the traffic passing through these applications.

Do you think I should post this as a vulnerability finding? I did a research for about a day, but I couldn't find any clear idea about tightening methods. If I have to write it as a finding, what are the tightening methods and solution suggestions? Can you help me?

Thank you.

1 Answer 1

1

You cannot prevent someone from bypassing SSL pinning. This is because the verification is done on a device, which the attacker controls.

An attacker can find the function, which determines whether a certificste should be trusted or not, and patch it in memory to always return true.

As a result, don't spend any time trying to "harden" this, as attackers can always circumvent it on their own device.


As for an attacker without device access, that is a different game. You'd have to describe how it was circumvented, so we can give recommendations.

2
  • first of all thank you for your answer, i bypassed the app from my own device. Frankly, I'm new to mobile application security, so I had question marks in my mind. But I think it would be strange to write this as a finding and propose a solution.but it can still complicate the attack of the attacker, right?
    – Exnovan
    Oct 8, 2022 at 7:55
  • Likely the only way to harden device corruption is some form of secure boot. This is a device issue, not an app issue.
    – user10489
    Oct 8, 2022 at 14:35

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .