A technique to circumvent SSL/TLS validations on iOS devices

作者：D'Orazio, Christian J.; Choo, Kim-Kwang Raymond^*

来源：Future Generation Computer Systems-The International Journal of eScience, 2017, 74: 366-374.

DOI：10.1016/j.future.2016.08.019

• Certificate and public key validation
• MiTM
• Security
• iOS security
• SSL pinning
• OpenSSL

SSL/TLS validations such as certificate and public key pinning can reinforce the security of encrypted communications between Internet-of-Things devices and remote servers, and ensure the privacy of users. However, such implementations complicate forensic analysis and detection of information disclosure; say, when a mobile app breaches user's privacy by sending sensitive information to third parties. Therefore, it is crucial to develop the capacity to vet mobile apps augmenting the security of SSL/TLS traffic. In this paper, we propose a technique to bypass the system's default certificate validation as well as built-in SSL/TLS validations performed in iOS apps. We then demonstrate its utility by analysing 40 popular iOS social networking, electronic payment, banking, and cloud computing apps.

• 出版日期2017-9
• 单位中国地质大学（北京）