Decline any custom ssl certificate in a mobile application

Question

Consider the following scenario.

Eve creates an access point in a public place.
Alice connects to the AP via mobile phone and starts browsing the Web.
Eve redirects Alice to a registration page and suggests to Alice to read and accept terms and conditions bla-bla and install an SSL certificate.
As far as Alice is an ordinary mobile user, she thoughtlessly installs the certificate (she just clicks the Okay button since the registration message contains more than 140 characters). Most important is that it's a one-step procedure on most mobile devices.
Now Eve can perform a MITM attack. She can hijack HTTP(S) traffic.

Consider yourself as a Bob's mobile application developer. How can we prevent the described attack? Can we even do that? Feel free to suggest your solution for any mobile OS.

score 6 · Accepted Answer · answered Apr 29 '14 at 01:08

6

If you're the application developer the best you can probably do is pin the certificate, meaning if you see any certificate other than a specific one you know and trust (e.g. by comparing thumbprint or public key), drop the connection and get out of there.

Otherwise you're relying on a system that you have proven to be broken, as per your example. There are some practical issues with your attack though, in that installing a root certificate is a wee bit more complicated than a single click and hopefully users aren't that dum--nevermind.

answered Apr 29 '14 at 01:08

Steve

15,155
3
37
66

Yes, I was thinking about comparing public key. I will appreciate if you could give me an example implementation. – newbie Apr 29 '14 at 01:36
About the attack: at least for iOS and WP installing a root certificate is just a couple of taps AFAIK. – newbie Apr 29 '14 at 01:38
2

@newbie Certificate pinning is the solution you want to research. – deed02392 Apr 29 '14 at 11:18

Decline any custom ssl certificate in a mobile application

1 Answers1