Important Controls for a Mobile Application and Why

If you are looking for the complete guide for a level of security, You must refer to "Mobile Application Security Verification Standards by Open web application security project (OWASP MASVS). MASVS provides levels of security required based on the nature and use of your application. MASVS has  Detailed verification requirements. The security requirements are categorized such as Architecture, design & threat modeling and  Data storage and privacy, etc... MASVS-L1 is the basic level of security requirements recommended by OWASP.

MASVS-L2 lists additional defense-in-depth measures such as SSL pinning. If you achieve the MASVS-L2 level does not cover the root/jailbreak detection and Tampering. Root/jailbreak detection and Tampering is included in the MASVS-R. But MASVS-L2 is recommended for applications such as mobile banking and with a little effort, it is really easy to bypass SSL Pinning. If you want to know more about bypassing SSL Pinning with Inspeckage, Please refer to my previous writing. 

Implementing SSL Pinning correctly and securely means, implementing the controls that prevent bypassing SSL Pinning as well. Therefore the following are the three main controls to consider if your application needs to be protected from intercepting traffic and achieve MASVS-L2. 

1. SSL Pinning 
2. Root/Jailbreak Detection
3. Tampering and Repackaging 

1. SSL Pinning
One of the most vital security control for a mobile application is "SSL Pinning". Most of the attacks are done with intercepting traffic with a proxy such as BurpSuite or ZAP. Therefore,  a control that discourages intercepting traffic is required, and "SSL Pinning" is the main control used at the moment. 

2. Root/Jailbreak Detection

If your application is allowed to run on a rooted/jailbroken device, it is more vulnerable than an application with root/jailbreak detection. One I want to highlight is the possibility of bypassing SSL Pinning with hooks. You can read about bypassing SSL Pinning with "Inspeckage" here. So even if you discourage intercepting traffic with SSL Pinning, If you allow your application to run on a rooted/jailbroken device, still it is possible to intercept traffic from your mobile application. 

3. Tampering and Repackaging 

Let's assume that your mobile application has SSL Pinning and root/jailbreak detection implemented. Still, there are ways to bypass SSL Pinning. You can read a nonconventional method of bypassing SSL pinning without a rooted device here. One common and conventional method is with "Frida" and most of these conventional methods are done with Repackaging the mobile application APK with a third-party tool like "Frida".

So if you are thinking about implementing "SSL Pinning", probably it is a security requirement of your application or you may want to achieve MASVS-L2. Implementing SSL Pinning will definitely,  discourage attackers. But still, even a "script kiddie" might find a way to bypass SSL Pinning if your application is allowed to run on a rooted/jailbroken device. 

SSL Pinning + Root/Jailbreak detection will further discourage attackers but a motivated attacker with some knowledge and skills can still Repackage the application with a tool such as Frida and still find a way to bypass SSL Pinning. Therefore tampering and repackage must also be implemented if you want to achieve better results with SSL Pinning.  

This article intends to use with security testing, ethical hacking, and to increase the awareness of cybersecurity. Any malicious use is not intended. 

Reference

• OWASP Mobile Security Testing Guide
• The Mobile Application Security Verification Standard

SSL Pinning Bypass without a Rooted Device

Bypassing SSL Pinning 

If it is not possible to intercept traffic even after successfully installing own CA based on the android version, it is possible that the application is performing some kind of SSL pinning. to bypass this type of validation we need to hook the application’s code and interfere with the validation process. In order to use these hooks, the application must be allowed to run on a rooted/jailbroken device. If running on a rooted device is allowed, please read my previous article on SSL Pinning Bypass with "Inspeckage" and setting up "Inspeckage" for using other available hooks with the Xposed module and "Inspeckage". 

If the application is not allowed to run on a rooted device, the most common method is with the "Frida" framework. For this, you need to repackage the "APK" with the "Frida" library.  So if the application does not allow repackaging or use integrity checks at runtime this option is no longer valid. 

This is written based on an experience I had with bypassing SSL Pinning for mobile applications that do not allow to run on a rooted device and also did not allow repackaging and running on a device. The solution was found with "VirtualXposed" and "Inspeckage". However, this is not a widely tested and approved solution (UNCONVENTIONAL). But this might help you with mobile application Penetration Testing. 

VirtualXposed

VirtualXposed is the same as a virtual machine.  It provides a virtual space to run APKs as plugins and in this space, some Xposed modules and hooks can be applied. You can download the VirtualXposed from the following link.

VirtualXposed - https://virtualxposed.com/ 

Copy VirtualXposed apk and Install

This will download as an "apk" file. Now all you need to do is enable "Unknown source" from device security to allow installation of applications from both trusted and unknown sources, and install the "VirtualXposed" apk. 

1. Download VirtualXposed
2. Copy downloaded apk to your unrooted device.  
3. Go to device Settings > Security > Unknow source and tick Unknown source
4. Go to the location that you copied the apk
5. Tap and go through the installation guide

Now you will see the VirtualXposed icon with the other installed android applications. Click and open the "VirtualXposed" and you will see a lock screen like interface. This is the virtual space that is installed on your device OS. Swipe like you unlock a device with no password or pattern lock and enter to your virtual android space.

VirtualXposed installed on a not rooted device

Bypass SSL Pinning with VirtualXposed. 

Now that you have Xposed running on your unrooted device, you can use hooks. My favorite application for hooks is "Inspeckage"

1. Click on the Xposed inside the virtual space
2. You will be presented with an interface exactly similar to Xposed
3. Navigate to Download and search for "Inspeckage"
4. Click Download and Install 
5. After successfully installing the "Inspeckage" navigate to Modules and check the box next to "Inspackage" to enable it
6. Restart the device before using 

The following screen captures show steps to be followed in order to install and configure "Inspeckage". I will not explain the steps in detail here. 

Steps to install and configure Inspeckage

Now all you have to do is install the application that you want to bypass SSL pinning and intercept traffic to the same virtual space. You have to install the application from an apk in order to load the application to the virtual space. 

1. Extract/Get the "apk" that you want to install in the virtual space. 
2. Copy it to the desired location of your device
3. Try to install the apk and it will ask where to install (Add to VirtualXposed or Package Installer) 
4. Choose "Add to VirtualXposed" and continue the installation. 
5. You should be able to successfully install the application into virtual space (VirtualXposed)

Installing an application to the VirtualXposed

Now it is straight forward. Just like how you normally use "Inspeckage", run Inspeckage and select the application that you want to apply hooks, and load the Inspeckage web portal. 

1. Open Inspeckage in VirtualXposed
2. Click on the "Choose Target" dropdown
3. Select the application you want to apply hooks 
4. Click "Launch App" 
5. Open your web browser from the PC and navigate to the given IP in "Inspeckage" 
6. Go to "settings" from the web portal
7. Switch on the "SSL Uncheck" option 

Now you should be successfully able to bypass SSL Pinning and apply other hooks available with "Inspeckage". 

Again, I would like to highlight that this is not a well tested and established approach (
UNCONVENTIONAL). But I was able to successfully do some tricky things with "VirtualXposed" 

This article intends to use with security testing, ethical hacking, and to increase the awareness of cybersecurity. Any malicious use is not intended. 

References 
VirtualXposed - https://virtualxposed.com/
Inspeckage - http://ac-pm.github.io/Inspeckage/