Defending Against MITM Attacks: The Android Certificate Pinning Approach

Security is a top priority in the ever-changing environment of mobile app development. Because Android is the most popular mobile operating system, it is a great target for cyber attacks. To strengthen our defense systems, we must investigate sophisticated security methods, and one such technique that merits our attention is “Certificate Pinning.”

In this tutorial, we’ll take a look at the nuances of certificate pinning on Android. We’ll look at what certificate pinning is and why it’s important for app security. We’ll also look at the frightening prospect of a “Man-in-the-Middle” (MITM) attack and how certificate pinning may help protect against it.

Certificate pinning, like every security technique, has drawbacks, and we’ll be open about the possible difficulties and issues involved with its implementation. Not to worry, we’ll walk you through the process of getting a certificate and, more importantly, show you how to successfully utilize certificate pinning in your Android applications.

So buckle up as we begin on this educational adventure, equipping ourselves with the information and abilities required to secure our Android apps from the ever-present threat of cyber attacks. Let’s explore the realm of certificate pinning and reinforce our Android apps for a more secure digital future.

What are “Man-in-the-Middle” (MITM) attacks?

Man-in-the-Middle (MITM) attacks are a sneaky and dangerous type of cyber threat that may devastate a user’s online security and privacy. An unauthorized third party intercepts and eavesdrops on communication between two parties who believe they are directly linked, often a user and a trusted server or website, in these attacks. The attacker sneaks into the center of the communication flow, hence the term “Man-in-the-Middle.”

How does it work?

1. Interception: The attacker positions themselves between you and the destination server. Your data passes through them unbeknownst to you.
2. Monitoring: The attacker can monitor the data passing through and even modify it without your knowledge. They can see your login details, financial data, or any other sensitive information in plain text.
3. Relaying: Some MITM attackers may also relay the intercepted data to its intended destination, allowing the communication to proceed seemingly normally. You may not even realize you’ve been compromised.

What are the dangers?

MITM attacks pose significant dangers to users, including:

1. Data Theft: Attackers can steal sensitive information, such as usernames, passwords, credit card numbers, or personal messages, leading to identity theft, financial loss, or privacy breaches.
2. Identity Spoofing: By impersonating you or the trusted server, attackers can deceive you into divulging even more sensitive information or perform actions on your behalf without your consent.
3. Financial Loss: MITM attacks can lead to unauthorized financial transactions, emptying your bank account or maxing out your credit cards.
4. Privacy Invasion: Personal messages, photos, and other private data can be exposed, leading to embarrassment, harassment, or extortion.
5. Compromised Security: If you’re using apps or websites for secure tasks like online banking, healthcare, or shopping, MITM attacks can compromise your security and trust in these services.

In conclusion, Man-in-the-Middle attacks are a user’s worst nightmare since they can result in serious repercussions such as money loss, identity theft, and invasion of personal privacy. Recognizing the threats of MITM attacks highlights the significance of strong security measures, such as certificate pinning, to protect user data and online interactions.

What is Certificate Pinning?

Certificate pinning is a security practice that limits the number of trustworthy digital certificates that an application will accept from a server in order to create a safe connection. Rather of relying exclusively on the public key infrastructure (PKI) paradigm, in which a large number of certificate authorities (CAs) issue certificates, certificate pinning requires the application to trust only certain certificates or public keys linked with a trusted institution.

How does it work?

1. Initial Trust Establishment: When you first connect to a server or website, your application checks the server’s digital certificate, which is issued by a trusted CA. If the certificate is valid and signed by a trusted CA, the connection proceeds without any issues. This is the traditional PKI-based trust establishment.
2. Pinning Configuration: Certificate pinning takes it a step further. Instead of relying solely on the CA’s certificates, the application also checks a predefined set of certificates or public keys that it expects the server to present during the connection.
3. Comparison: During the connection process, the application compares the server’s certificate with its pinned certificates or keys. If they match, the connection proceeds. If there’s a discrepancy, the application raises a red flag and terminates the connection.

The Caveats

While certificate pinning is an effective security technique, it is important to recognize that, like every security method, it has drawbacks and obstacles. These disadvantages frequently center on the trade-off between increased security and operational complexity:

1. Maintenance Overhead: Certificate pinning requires regular maintenance. As certificates expire or need to be updated, developers must modify the pinned certificate/key list within the application. This can be a cumbersome and time-consuming process, especially in large-scale applications.
2. Risk of Outages: If not managed correctly, updates to pinned certificates can lead to service disruptions if the new certificates are not propagated in a timely manner. Balancing security updates with service up-time can be a delicate task.
3. User Experience: Certificate pinning can be unforgiving. If a server’s certificate changes due to legitimate reasons, such as a certificate renewal or infrastructure upgrade, users may encounter errors and connection issues until the application is updated to recognize the new certificate.
4. Debugging Complexity: Troubleshooting and diagnosing issues related to certificate pinning can be challenging. Pinning-related errors may not provide clear error messages, making it difficult to pinpoint the exact issue.
5. Limited Security Scope: While certificate pinning provides robust protection against MITM attacks, it is not a panacea for all security threats. It does not address vulnerabilities like server-side attacks, application-level flaws, or other attack vectors that can compromise security.
6. Reduced Scalability: Managing a pinned certificate list becomes more challenging as the number of servers or services your application communicates with increases. Scaling the pinning process can be complex and may require additional resources.
7. Incompatibility with Some Network Changes: Certain network configurations, such as load balancing, content delivery networks (CDNs), or failover mechanisms, can be disrupted by strict certificate pinning. Ensuring compatibility with these configurations can be tricky.
8. Resistance to Updates: Some users may delay or resist updating the application to the latest version, especially if they encounter disruptions due to certificate changes. This can lead to a fragmented user base running older, potentially less secure versions of the app.

To prevent these risks, developers must carefully design and execute certificate pinning, manage an efficient certificate updating process, and properly explain changes to users. Furthermore, it is critical to find a balance between the security benefits of pinning and the possible negatives in order to retain a great user experience while maintaining a strong security posture.

Getting a key from a certificate

Step 1: Connect to the Server and Retrieve the Certificate

Open a terminal and execute the following command to connect to the target server (replace example.com with the actual server hostname or IP address):

openssl s_client -connect example.com:443 -showcerts < /dev/null | openssl x509 -outform der > server_cert.der

This command establishes an SSL/TLS connection to the server, retrieves its certificate, and saves it in DER format as server_cert.der.

Step 2: Extract the Public Key

Next, use the following command to extract the public key from the DER-encoded certificate and save it in PEM format as server_cert_public_key.pem:

openssl x509 -inform der -in server_cert.der -pubkey -noout > server_cert_public_key.pem

This command converts the DER certificate into a PEM format and extracts the public key.

Step 3: Calculate the SHA-256 Fingerprint

Now, calculate the SHA-256 fingerprint of the public key using the following command:

cat server_cert_public_key.pem | openssl rsa -pubin -outform der | openssl dgst -sha256 -binary | openssl enc -base64

This command performs the following actions:

• Converts the PEM public key into DER format.
• Calculates the SHA-256 hash of the DER-encoded public key.
• Encodes the hash in base64 format, which is the format Android expects for certificate pinning.

The result is the SHA-256 public key fingerprint that you can use in your Android application for certificate pinning.

Important Note: Make sure to replace example.com with the actual server you want to establish a secure connection with. Additionally, integrate this SHA-256 fingerprint into your Android application’s code to enable certificate pinning and enhance your app’s security.

Step 4: Add the key to your your android project

Once you have the key, simple place it in your `strings.xml` resource file. Ideally as a string array, as you can trust multiple certs at a given time.

<string-array name="cert_pins" translatable="false">
    <item>sha256/flkjfg8WrJFSisd87609ifdlkjdf</item>
</string-array>

Implementing it on Android

Adding a certificate pin on Android is surprisingly easy when using OkHttpClient & Retrofit:

val certificatePinner = CertificatePinner.Builder()
    .add(serverHostName,  *context.resources.getStringArray(R.array.cert_pins))
    .build()

Conclusion

We’ve learned about certificate pinning and how it works as a strong defense against Man-in-the-Middle (MITM) attacks along the way. We’ve acknowledged its significance in improving Android app security, as well as its potential hazards and complications.

While certificate pinning necessitates care and maintenance, its importance in protecting sensitive data and sustaining user confidence cannot be overstated. By limiting the scope of trusted certificates to a few, we get an advantage against attackers looking to infiltrate our apps.

Let us emphasize the need of establishing a balance between security and user experience as we continue our examination of certificate pinning. While strong security measures are essential, they must coexist with user-friendly apps. The keys to establishing this equilibrium are effective communication and smart management of certificate changes.

Certificate pinning is a beacon of resilience in the ever-changing field of mobile app security, guaranteeing that Android users can engage with confidence, knowing that their data is safe from prying eyes. It demonstrates our dedication to the safety and privacy of individuals who rely on our applications.

Let us embrace certificate pinning as a strong tool to reinforce our Android applications and contribute to a safer digital ecosystem as developers, security practitioners, and digital custodians. We can strengthen the trust foundations on which the digital world is founded by working together to ensure that users can traverse it securely, confidently, and with peace of mind.