A Framework to Secure the Development and Auditing of SSL Pinning in Mobile Applications: The Case of Android Devices

Autor:	Francisco José Ramírez-López, Ángel Jesús Varela-Vaca, Jorge Ropero, Joaquín Luque, Alejandro Carrasco
Jazyk:	angličtina
Rok vydání:	2019
Předmět:	ssl pinning security mobile applications android auditing vulnerabilities owasp Science Astrophysics QB460-466 Physics QC1-999
Zdroj:	Entropy, Vol 21, Iss 12, p 1136 (2019)
Druh dokumentu:	article
ISSN:	1099-4300
DOI:	10.3390/e21121136
Popis:	The use of mobile devices has undergone rapid growth in recent years. However, on some occasions, security has been neglected when developing applications. SSL/TLS has been used for years to secure communications although it is not a vulnerability-free protocol. One of the most common vulnerabilities is SSL pinning bypassing. This paper first describes some security controls to help protect against SSL pinning bypassing. Subsequently, some existing methods for bypassing are presented and two new methods are defined. We performed some experiments to check the use of security controls in widely used applications, and applied SSL pinning bypassing methods. Finally, we created an applicability framework, relating the implemented security controls and the methods that are applicable. This framework provides a guideline for pentesters and app developers.
Databáze:	Directory of Open Access Journals
Externí odkaz:	https://doaj.org/article/d6d8aac7f2324f52bd7cbcc7f5f963af Zobrazit plný text záznamu View record in DOAJ Plný text ve formátu PDF Plný text ve formátu HTML
Nepřihlášeným uživatelům se plný text nezobrazuje	K zobrazení výsledku je třeba se přihlásit.