How SSL Pinning Reinforces iOS App Security
summary
Shows that TrustKit public-key pinning can be added in a few lines to URLSession and actually validate server keys, preventing MITM interception. Demonstrates bypass techniques using Objection + Frida gadget and sideloading on nonproduction builds, and shows a live MITM where an API key and movie titles are altered on the fly. Claims ~85–90% of App Store apps lack pinning, explains certificate vs public‑key pinning tradeoffs, and shows the pinned approach works in demo tests.
AI-written summary · about
chapters (12)
- 0:00Intro & Agenda
- 1:42App Security Requirements
- 3:14What is SSL Pinning
- 6:34How SSL Works
- 8:30Which method to use?
- 10:24Objection and Frida
- 12:12How to prevent bypassing of certificate pinning
- 14:22How to perform SSL Pinning in iOS?
- 15:39Why to use TrustKit and implement it?
- 17:04TrustKit Setup
- 17:50Pinning Validation
- 19:24Time for a Demo
related talks
47mSecurity Threats & Mitigations for iOS Developers
44mPractical Security
27miOS Attack Vectors and how to protect your app
28mApp Security Essentials
46mSelf-Signed, Why Not! Exploiting Insecure Certificate Validation In iOS And macOS
36mTesting iOS Apps without Jailbreak in 2018
52mWhere, how, and why is SSL traffic on mobile getting intercepted?
37mOutsmarting Hackers before your App gets pwn'ed