Mobile network security

hard

Learn with your AI

Open this lesson in your favourite AI. It'll walk you through the why, explain the demo, and quiz you on the try-it list.

Open in Claude Open in ChatGPT

Why this matters

Mobile apps talk to backends over (usually) TLS. Common bugs: TLS misconfig (trust any cert), certificate pinning missing or implemented wrong (allows MITM via custom CA), API authentication mistakes. Reverse-engineerable apps + intercepting proxies = an attacker can replay and modify API calls trivially without certificate pinning.

Demo

Defence: TLS 1.3 only, certificate pinning (TrustKit on iOS, NetworkSecurityConfig on Android), pin to public key hash (survives cert rotation), and document pinning rotation. Plus: re-do pinning at the app layer; OS-level pinning has been bypassable.

Try it yourself

Set up Burp Suite as an MITM. Connect a phone, install Burp cert, intercept traffic. Note that without pinning the app is open.
Add certificate pinning. Re-test; Burp should now fail.
Read the OWASP Mobile guide on TLS / pinning.

Prompt your AI

Use these three in order. Each builds on the one before.

1. Basics & terminology

In one paragraph, explain mobile cert pinning.

2. Why it works (the mechanism)

Walk me through key-pinning vs cert-pinning, and rotation.

3. Advanced — application & what's next

Design pinning for an app whose cert rotates monthly.