Where, how, and why is SSL traffic on mobile getting intercepted?
summary
Analysis of 10 million reports from ~2,000 apps shows 3 million unique certificate chains and splits incidents into concrete causes: developer proxies (Charles, Fiddler, Burp), corporate appliances (2% of reports, often downgrading keys), pinning misconfiguration (34% of MITM-class reports, catastrophic outages like the Barclay payment failure), and surprisingly large market‑intelligence spyware (≈39%) where apps or Mobile-Expression/comScore profile installs push an always‑on VPN plus a custom root CA to decrypt traffic; recommended defenses are SSL reporting for visibility and cautious, multi‑key pinning with ops coordination.
AI-written summary · about
chapters (16)
- 0:00Intro
- 2:52SSL Pinning
- 4:20SSL Reporting
- 9:18The Data Set
- 11:24Report Classification
- 16:57Server Misconfiguration
- 19:15Classification Categories
- 19:39Development Proxies
- 21:28Corporate Networks
- 22:47Pins Misconfiguration
- 27:50Spyware Categories
- 33:46What Happened?
- 37:41Spyware - Market Intel
- 39:59Spyware - Ad Blocker
- 41:36Spyware - Parental Control
- 43:32What do we do?
related talks
48mMobile Security Attacks: A Glimpse from the Trenches
45mTen Secrets to Secure Mobile Applications
39mMobile App Security
24mMobile - Your API Security Blindspot
21mSecuring the Unseen: Advanced Threats, Best Practices & Challenges in Mobile App Security
57m(In)Security of Mobile Banking
48mChain of Fools: An Exploration of Certificate Chain Validation Mishaps
25mHow SSL Pinning Reinforces iOS App Security