We've been discussing a possible attack vector where a rogue app with root rights could hijack the legit ssl session of anther local app and transmit its own data over it without the server being able to detect it (Edit: our app uses ssl cert pinning).
- What would the rogue app need to do to achieve that?
- Are there any documented cases (especially for Android)?
- How could we prevent this?
(I know, the rule of thumb is that there's no protection if the attacker has root access, but we wonder whether this was / could be exploited in a practical way)