Mobile Development and Security: Certificate Pinning on Android

In today’s increasingly interconnected digital world, the importance of security for mobile apps and web services cannot be overstated. As cyber threats evolve, so must the defenses and measures we deploy to safeguard sensitive data and maintain trust. One of the pivotal practices in enhancing network security is certificate pinning, a technique that ensures a mobile app or web service communicates only with the designated server. But before delving into cert pinning Android mechanisms, it’s essential to understand the foundational role of SSL certificates in our security architecture.

SSL certificates serve as a bedrock for online trust and secure communication. They operate within the HTTPS protocol, ensuring that the communication between a client app and a server remains encrypted and safe from prying eyes. When a client, like a mobile app or browser, connects to a secure web server, the server presents its SSL certificate as proof of its identity. This certificate is then checked against a list of trusted certificates stored in the client’s operating system. If the server’s certificate is trusted, an encrypted communication channel (often referred to as a secure connection) is established. This is the foundation of the HTTPS connection.

However, what if the very process of verifying the server’s certificate is compromised? Cybercriminals, with the power of man-in-the-middle attacks, can present fake certificates and mislead clients into believing they are communicating with a legitimate server. This is where certificate pinning makes its grand entrance. Instead of relying on the verification of a presented certificate against the broad list of trusted root certificates, certificate pinning ensures that the app communicates only with the server that has the specific, pre-defined certificate or public key.

By implementing certificate pinning, developers can significantly mitigate the risk of man-in-the-middle attacks, even if an attacker has a valid certificate issued by a trusted certification authority. It’s like adding an extra layer of armor, ensuring that the app communicates only with its designated server, enhancing the security level.

SSL connection vs pinning

In a typical SSL connection, when a client app or browser attempts to establish a secure communication channel with a server, it verifies the server’s certificate against a list of trusted root certificates. If the certificate is issued by one of these trusted entities, the connection is deemed secure. However, this broad trust model can be exploited if any of the certificate authorities is compromised.

Pinning, on the other hand, narrows this trust model. Instead of trusting any certificate from a valid certificate authority, the client app is coded to expect only a specific certificate or public key. This means that even if an attacker presents a seemingly valid certificate from a trusted authority, the app won’t be deceived if the certificate doesn’t match the pinned expectations.

Choices for pinning in Android app

In the landscape of security, there are various methods to achieve certificate pinning on Android, each with its unique advantages and potential drawbacks. Here’s a look at the most popular choices:

Certificate pinning

Certificate pinning involves binding a particular server’s certificate to a mobile app. This means that the app is hard-coded to expect a specific certificate when establishing a connection with the server.

Benefits

• Enhanced Security: By pinning the exact certificate, apps add an extra layer of protection against man-in-the-middle attacks. Even if an attacker manages to obtain a valid certificate for a domain, the app won’t trust it unless it matches the pinned certificate.
• Simplicity: Once set up, certificate pinning offers a straightforward approach, ensuring that the app communicates only with the intended server.

Drawbacks

• Certificate Rotation: One of the main challenges with certificate pinning is that certificates have expiration dates. When a certificate expires, it needs to be replaced. Therefore, apps that use certificate pinning will need regular updates to incorporate the new certificate, which can be cumbersome for developers and users alike.

Public key pinning

While certificate pinning relies on the server’s certificate, public key pinning focuses on pinning the server’s public key. As certificates may change, the underlying public key often remains consistent.

Extracting a public key from a certificate involves accessing the certificate details and retrieving the public key component. This extracted public key is then used for pinning, ensuring that as long as the backend server uses the same public key, the app will trust the connection.

Benefits

• Flexibility: Since public keys remain consistent even if the certificate changes, public key pinning offers more flexibility, reducing the need for frequent app updates.
• Consistent Security: Like certificate pinning, public key pinning also ensures a secure communication channel, guarding against potential cyber threats.

Challenges

• Implementation Complexity: Extracting and managing public keys requires a deeper understanding of cryptographic operations, which might be challenging for some developers.

Hashing

Hashing involves creating a fixed-size string (hash) from input data of any size. In the context of pinning, hashing can be used to create a digest of a server’s certificate or public key, and the resulting hash is then used for pinning.

Benefits

• Anonymizing: Hashing anonymizes the data, ensuring that the original certificate or public key can’t be deduced from the hash. This adds an extra layer of protection against potential threats.
• Convenience: Instead of managing the entire certificate or public key, developers can work with the fixed-size hash, making the process more streamlined and convenient.

Challenges

• Hash Collisions: Though rare, two different inputs producing the same hash can lead to potential security defects. Choosing a robust hashing algorithm is crucial to prevent such scenarios.

Methods of implementing certificate pinning in Android

As mobile app security becomes paramount, developers are seeking robust methods to fortify their apps. Certificate pinning in Android offers a solution, providing an additional layer of security beyond standard SSL certificates. This section delves into various methods to implement certificate pinning on the Android platform.

Using Trust Manager

Trust Managers form the bedrock of SSL connections within Android. Their primary task is to ascertain the reliability of a server’s certificate. By creating a custom Trust Manager, developers can enforce a stringent verification process. This involves juxtaposing server certificates against a curated list of trusted certificates. The inherent advantage of this method is the granular control it affords, allowing for tailored certificate validation processes.

OkHttp and CertificatePinner

OkHttp, a household name in the Android and Java communities, inherently supports certificate pinning. The CertificatePinner class streamlines the pinning implementation, coupled with the boon of effective connection management. This, in turn, trims down overhead and lag. To leverage this, developers must integrate the OkHttp library and subsequently employ the CertificatePinner class. This class facilitates the setting of anticipated certificates or public key hashes for particular hosts.

Android Pinning Library

As a standalone toolkit, it eases the process of embedding certificate or public key pinning into Android applications. After integrating this library into their project, developers can craft a configuration that elucidates the host and the anticipated certificate or public key hash. The final step involves initializing the library during the app’s launch, referencing the pre-defined configuration. A salient advantage of this method is the separation of pinning logic, ensuring greater configurational agility.

Network Security Config + TrustKit Android Library

The procedure begins by adding TrustKit to the project’s build.gradle. Developers then sculpt a pinning policy, leveraging the network security configuration. The next phase involves designating the path to this XML policy in the App’s manifest, activating it as the app’s fundamental network security configuration. TrustKit is then initiated using this path. Once this foundation is laid and the SSLSocketFactory is attuned, TrustKit embarks on verifying the server’s certificate chain. This verification aligns with the pre-set pinning policy, executed with every HTTPS connection initiation. A noteworthy feature of TrustKit is its integration with the app’s network security protocols. Moreover, it can transmit reports to a specified URI in instances of pin validation failures. However, one must be mindful of its limitations, especially concerning the OkHttpHelper solutions. Here, it’s pivotal to deactivate redirects since the pinning only effectively operates on the initial request, neglecting any consequent redirects.

Getting SSL pins

SSL pins, the very essence of certificate pinning, play a crucial role in ensuring that an Android app communicates securely with its intended server. These pins, typically hashes of the public keys found in a server’s certificate, are used to verify that the presented certificate during a TLS handshake indeed comes from a trusted source. To set up certificate pinning, it’s essential to ascertain the correct pins. Let’s delve into the process of acquiring these SSL pins for your Android application.

To begin with, one must choose the domains and public keys for pinning. This is foundational and involves the selection of domains your app will be communicating with. For most applications, this will likely be the backend server or API host. However, if your app interacts with multiple domains, you’ll need to pin each of these domains separately. Beyond the domain itself, it’s prudent to pin the intermediate certificates, which are less prone to change, rather than the leaf certificate, which might get rotated frequently.

Once the domains are crystal clear, we can plunge into the technicalities of obtaining the pins. A commonly employed tool in this process is OpenSSL, a robust, full-featured open-source toolkit that implements the Secure Socket Layer (SSL) and Transport Layer Security (TLS) protocols.

To obtain and hash the public key from a certificate using OpenSSL, you can follow these procedures:

1. First, you need to fetch the certificate of the domain. This can be achieved using:echo | openssl s_client -servername example.com -connect example.com:443 | openssl x509 -pubkey -noout > pubkey.pemReplace example.com with your domain.
2. Next, the extracted public key can be hashed to generate the pin:openssl pkey -in pubkey.pem -pubin -outform der | openssl dgst -sha256 -binary | openssl enc -base64This command will output a Base64 encoded string, which represents the hash of your server’s public key. This is the value you’ll be using as the SSL pin in your Android application.

In addition to OpenSSL, there’s another user-friendly tool at your disposal: SSL Labs. SSL Labs provides a comprehensive analysis of the configuration of any SSL web server on the public internet. To get the pin for the host using SSL Labs:

1. Navigate to the SSL Labs’ test page.
2. Input your domain in the provided field and initiate the test.
3. Once the test completes, navigate to the ‘Server’ section and click on a server id. Here, you’ll observe the server’s certificate chain, and each certificate will have its associated public key hash. These hashes can be used as SSL pins for your app.

It’s worth noting that regardless of the method you choose, ensure that you’re fetching pins in a secure environment to prevent any potential tampering. Moreover, always maintain a backup pin to cater to situations where the primary certificate expires or is replaced.

Benefits of certificate pinning on Android

For Android applications, which constitute a significant portion of mobile app usage worldwide, security is paramount. While the traditional SSL/TLS protocols play a vital role in ensuring encrypted communication, certificate pinning adds an extra layer, bringing a plethora of benefits to the Android ecosystem.

One of the foremost benefits is enhanced security against Man-in-the-Middle (MiTM) attacks. In a MiTM attack, an unauthorized party intercepts the communication between two systems. Imagine sending a confidential letter through a courier, but an impostor intercepts it mid-way, reads its content, perhaps alters it, and then sends it onward to the recipient, all the while neither the sender nor the recipient realizing the breach. That’s essentially what happens in a MiTM attack, but in the realm of digital data. When an Android app employs certificate pinning, it doesn’t just rely on the SSL/TLS protocols for security. Instead, it explicitly checks the server’s certificate or public key against a known, pinned value. If there’s any discrepancy, the connection is terminated, thwarting potential MiTM attacks.

Beyond the mitigation of MiTM threats, certificate pinning assures the authenticity of the server. In the vast expanse of the internet, verifying the identity of entities is a monumental challenge. Certificate Authorities (CAs) were introduced to address this challenge by acting as trusted third parties that vouch for the authenticity of websites. However, there have been instances where CAs were compromised or mistakenly issued rogue certificates. With certificate pinning, Android apps don’t solely depend on the trustworthiness of CAs. By pinning a server’s certificate or its public key, apps can be certain they’re communicating with their intended server and not an imposter, ensuring the authenticity of the server.

Lastly, certificate pinning aids in the prevention of rogue certificates. A rogue certificate, as the name suggests, is a certificate that has either been mistakenly issued by a CA or maliciously acquired from a compromised CA. When such a certificate is presented to an app during the SSL/TLS handshake, it appears valid because it traces back to a trusted root. But with certificate pinning in place, Android apps are not easily fooled. Even if the certificate chain appears valid, the app will reject the connection if the certificate or its public key doesn’t match the pinned value.

Challenges and Precautions

A primary concern is the importance of regular updates due to certificate rotations. Certificates, by their very nature, have a finite lifespan. Once they expire, they need to be replaced to maintain a secure communication channel. This attribute poses a significant challenge for certificate pinning. If an Android app has pinned an old certificate and the server updates its certificate post-expiration, the app would reject connections to the server, mistaking it for a potential security threat. This emphasizes the necessity of vigilant updates in apps that employ certificate pinning. Developers need to be proactive, updating their pinned certificates well in advance of their expiration dates. A lapse in this can lead to service disruptions, affecting the app’s functionality and user experience.

Along with the need for timely updates, developers must be wary of potential pitfalls. One of the common pitfalls is the inadvertent pinning to a leaf certificate (the end-user certificate) instead of an intermediate or root certificate. While pinning to a leaf might seem like a sound strategy, it can backfire if the certificate is rotated frequently, requiring constant app updates. Pinning higher up the certificate chain can offer more flexibility. Another challenge is ensuring the pinned certificate is correctly installed and configured on the server. Any misconfiguration can lead to connection failures.

Network Security Testing Tools

With the challenges laid out, the natural progression is to employ tools that can help verify and fine-tune the pinning implementation. There’s a suite of tools available for developers to ensure the integrity of their pinning strategy.

Google’s nogotofail is a valuable tool that assists developers in spotting potential connection vulnerabilities, such as the mishandling of certificate validation or the usage of cleartext traffic. By leveraging this tool, developers can get insights into areas where their apps might be susceptible to threats.

Another noteworthy tool is the SafetyNet API. This is not just a single tool but a collection of services provided by Google to fortify app security. It encompasses features like safe browsing and integrity checks, acting as a guard against malicious traffic, phishing URLs, and more.

Last but not least, the Android Network APIs guide, which is part of the broader Mobile Security Testing Guide, offers invaluable insights and best practices. It is an essential resource for developers aiming to fortify their app’s network security posture, providing guidelines, methodologies, and hands-on techniques.

Conclusion

Certificate pinning emerges as a potent tool in the security arsenal, fortifying connections, assuring server authenticity, and shielding against insidious attacks. Throughout this article, we delved deep into the nuances of certificate pinning, exploring its significance, methods of implementation, benefits, and the accompanying challenges. We also highlighted the essential tools available to developers for verifying and optimizing their pinning strategies. The underlying message is evident: while certificate pinning is a powerful mechanism to bolster security, it demands meticulous implementation, regular updates, and consistent testing.