Mobile network security

Why this matters

Mobile apps talk to backends over (usually) TLS. Common bugs: TLS misconfig (trust any cert), certificate pinning missing or implemented wrong (allows MITM via custom CA), API authentication mistakes. Reverse-engineerable apps + intercepting proxies = an attacker can replay and modify API calls trivially without certificate pinning.

Demo

Defence: TLS 1.3 only, certificate pinning (TrustKit on iOS, NetworkSecurityConfig on Android), pin to public key hash (survives cert rotation), and document pinning rotation. Plus: re-do pinning at the app layer; OS-level pinning has been bypassable.

Try it yourself

1. Set up Burp Suite as an MITM. Connect a phone, install Burp cert, intercept traffic. Note that without pinning the app is open.
2. Add certificate pinning. Re-test; Burp should now fail.
3. Read the OWASP Mobile guide on TLS / pinning.

References

• TrustKit (iOS / Android pinning)
• OWASP MASTG — Network