TLS Certificate Pinning

[Cyberizm]

Objective-C:

Vulnerable Code:

- (void)connection:(NSURLConnection *)connection willSendRequestForAuthenticationChallenge:(NSURLAuthenticationChallenge *)challenge {
if([challenge.protectionSpace.authenticationMethod isEqualToString:NSURLAuthenticationMethodServerTrust]) {
SecTrustRef serverTrust = [[challenge protectionSpace] serverTrust];
NSString *domain = [[challenge protectionSpace] host];
SecTrustResultType trustResult;
SecTrustEvaluate(serverTrust, &trustResult);
if (trustResult == kSecTrustResultUnspecified) {
// Look for a pinned public key in the server's certificate chain
if ([SSLCertificatePinning verifyPinnedCertificateForTrust:serverTrust andDomain:domain]) {
// Found the certificate; continue connecting
[challenge.sender useCredential:[NSURLCredential credentialForTrust:challenge.protectionSpace.serverTrust] forAuthenticationChallenge:challenge];
}
else {
// Certificate not found; cancel the connection
[[challenge sender] cancelAuthenticationChallenge: challenge];
}
}
else {
// Certificate chain validation failed; cancel the connection
[[challenge sender] cancelAuthenticationChallenge: challenge];
}
}
}

Description: This vulnerable code implements certificate pinning by evaluating the certificate chain presented by a remote server. However, it only checks for a pinned certificate based on the domain, which may not be sufficient for robust security.

Patched Code:

- (void)connection:(NSURLConnection *)connection willSendRequestForAuthenticationChallenge:(NSURLAuthenticationChallenge *)challenge {
if([challenge.protectionSpace.authenticationMethod isEqualToString:NSURLAuthenticationMethodServerTrust]) {
SecTrustRef serverTrust = [[challenge protectionSpace] serverTrust];
NSString *domain = [[challenge protectionSpace] host];
SecTrustResultType trustResult;
SecTrustEvaluate(serverTrust, &trustResult);
if (trustResult == kSecTrustResultUnspecified) {
// Perform certificate pinning with additional checks
if ([self performCertificatePinningForTrust:serverTrust andDomain:domain]) {
// Found the certificate; continue connecting
[challenge.sender useCredential:[NSURLCredential credentialForTrust:challenge.protectionSpace.serverTrust] forAuthenticationChallenge:challenge];
}
else {
// Certificate not found; cancel the connection
[[challenge sender] cancelAuthenticationChallenge: challenge];
}
}
else {
// Certificate chain validation failed; cancel the connection
[[challenge sender] cancelAuthenticationChallenge: challenge];
}
}
}

- (BOOL)performCertificatePinningForTrust:(SecTrustRef)serverTrust andDomain:(NSString *)domain {
// Implement certificate pinning logic here
// Check if the server's certificate matches any of the pinned certificates
return [SSLCertificatePinning verifyPinnedCertificateForTrust:serverTrust andDomain:domain];
}

Description: The patched code enhances certificate pinning by adding additional checks in a separate method performCertificatePinningForTrust:andDomain:. This method allows for more comprehensive verification of the server's certificate, improving the robustness of certificate pinning.

Swift:

Vulnerable Code:

func connection(_ connection: NSURLConnection, willSendRequestFor challenge: URLAuthenticationChallenge) {
if challenge.protectionSpace.authenticationMethod == NSURLAuthenticationMethodServerTrust {
guard let serverTrust = challenge.protectionSpace.serverTrust else { return }
let domain = challenge.protectionSpace.host
var trustResult = SecTrustResultType.invalid
SecTrustEvaluate(serverTrust, &trustResult)
if trustResult == .unspecified {
// Look for a pinned public key in the server's certificate chain
if SSLCertificatePinning.verifyPinnedCertificate(for: serverTrust, andDomain: domain) {
// Found the certificate; continue connecting
challenge.sender?.useCredential(URLCredential(trust: challenge.protectionSpace.serverTrust!), for: challenge)
} else {
// Certificate not found; cancel the connection
challenge.sender?.cancel(challenge)
}
} else {
// Certificate chain validation failed; cancel the connection
challenge.sender?.cancel(challenge)
}
}
}

Description: This vulnerable Swift code implements certificate pinning by evaluating the certificate chain presented by a remote server. However, it only checks for a pinned certificate based on the domain, which may not be sufficient for robust security.

Patched Code:

func connection(_ connection: NSURLConnection, willSendRequestFor challenge: URLAuthenticationChallenge) {
if challenge.protectionSpace.authenticationMethod == NSURLAuthenticationMethodServerTrust {
guard let serverTrust = challenge.protectionSpace.serverTrust else { return }
let domain = challenge.protectionSpace.host
var trustResult = SecTrustResultType.invalid
SecTrustEvaluate(serverTrust, &trustResult)
if trustResult == .unspecified {
// Perform certificate pinning with additional checks
if performCertificatePinning(for: serverTrust, andDomain: domain) {
// Found the certificate; continue connecting
challenge.sender?.useCredential(URLCredential(trust: challenge.protectionSpace.serverTrust!), for: challenge)
} else {
// Certificate not found; cancel the connection
challenge.sender?.cancel(challenge)
}
} else {
// Certificate chain validation failed; cancel the connection
challenge.sender?.cancel(challenge)
}
}
}

func performCertificatePinning(for serverTrust: SecTrust, andDomain domain: String) -> Bool {
// Implement certificate pinning logic here
// Check if the server's certificate matches any of the pinned certificates
return SSLCertificatePinning.verifyPinnedCertificate(for: serverTrust, andDomain: domain)
}

Description: The patched Swift code enhances certificate pinning by adding additional checks in a separate method performCertificatePinning(for:andDomain. This method allows for more comprehensive verification of the server's certificate, improving the robustness of certificate pinning.


---


Professional Hacking Services Available
We offer ethical security assessments and penetration testing for iOS and Android mobile devices, websites, web apps, data servers, cryptography, operational security (OPSEC) posture reviews, digital footprint decontamination, account takeover (ATO) resistance audits, and adversarial reputation risk mitigation.

For inquiries:
E-mail: cyberizm@proton.me / cyberizm@dnmx.cc
Telegram: @cyb3rizm
Signal: cyberizm.88

Contact us for discreet, professional consultation and assistance.