Artículo
A framework to secure the development and auditing of SSL pinning in mobile applications: The case of android devices
Autor/es | Ramírez López, Francisco José
Varela Vaca, Ángel Jesús Ropero Rodríguez, Jorge Luque Rodríguez, Joaquín Carrasco Muñoz, Alejandro |
Departamento | Universidad de Sevilla. Departamento de Tecnología Electrónica Universidad de Sevilla. Departamento de Lenguajes y Sistemas Informáticos |
Fecha de publicación | 2019-12 |
Fecha de depósito | 2024-01-04 |
Publicado en |
|
Resumen | The use of mobile devices has undergone rapid growth in recent years. However, on some
occasions, security has been neglected when developing applications. SSL/TLS has been used for
years to secure communications although ... The use of mobile devices has undergone rapid growth in recent years. However, on some occasions, security has been neglected when developing applications. SSL/TLS has been used for years to secure communications although it is not a vulnerability-free protocol. One of the most common vulnerabilities is SSL pinning bypassing. This paper first describes some security controls to help protect against SSL pinning bypassing. Subsequently, some existing methods for bypassing are presented and two new methods are defined. We performed some experiments to check the use of security controls in widely used applications, and applied SSL pinning bypassing methods. Finally, we created an applicability framework, relating the implemented security controls and the methods that are applicable. This framework provides a guideline for pentesters and app developers. |
Agencias financiadoras | Junta de Andalucía European Commission (EC). Fondo Europeo de Desarrollo Regional (FEDER) |
Identificador del proyecto | RTI2018-094283-B-C33 |
Cita | Ramírez López, F.J., Varela Vaca, Á.J., Ropero Rodríguez, J., Luque Rodríguez, J. y Carrasco Muñoz, A. (2019). A framework to secure the development and auditing of SSL pinning in mobile applications: The case of android devices. Entropy, 21 (12), Article number 1136. https://doi.org/10.3390/e21121136. |
Ficheros | Tamaño | Formato | Ver | Descripción |
---|---|---|---|---|
A framework to secure.pdf | 876.4Kb | [PDF] | Ver/ | |