January 11, 2019
Here are a few ways to prevent Man In the Middle attacks in iOS and Android platforms by implementing certificate pinning as a security measure.
A key differentiator of successful mobile apps today is that they provide contextual, relevant and personalized information to their users. As the apps capture personal data like email and location, developers now have a larger role to play in enabling secure data transmission and use.
Here are a few ways to prevent Man In the Middle (MiM) attacks in iOS and Android platforms by implementing certificate pinning as a security measure.
What is MiM?
A man-in-the-middle (MiM) attack is a cyberattack where a malicious actor inserts him/herself into a conversation between two parties, impersonates both parties and gains access to information that the two parties were trying to send to each other.
Why do we need certificate pinning?
MiM attacker can impersonate the actual service and thereby take complete control of the application. It is here that certificate pinning is introduced to minimize opportunities for gaining wrongful access to the service.
When should certificate pinning be deployed?
While keeping user information secure is vital to any application, certificate pinning is essential for apps that handle sensitive user data like email address, credit card information or some related data over network which can alter reputation of an individual.
Certificate pinning in iOS
Certificate pinning in iOS can be achieved by using Security Framework or by any third-party software developer’s kits like TrustKit.
Security framework provides two methods for pinning:
In the first case, the actual certificate is bundled into an app. When user information is loaded, the software matches it with the data in the certificate, which is obtained from the server. The programme proceeds only if the comparison is successful – else, it fails to establish the connection. Certificates are issued by secure hosting providers. It is obtained by placing a request or by enquiring with ssllabs.com. One way in which iOS implements certificate pinning is by copying these files to the application bundle and then perform the validation while application is running.
In the second method, public key hashes are saved within the app. They are then extracted from server certificates. The
program then proceeds in the same manner as the first case.
In case of iOS app, pinning with public key hashes with multiple certificates for same host was available only from iOS 10 as per built in Security Framework by Apple.
Securing an Android App
To prevent Man in the Middle Attack, an Android app trusts all pre-installed certificate authorities. However, apps have the freedom to choose the certificate pinning. If a certificate is one of the public keys provided, it is considered valid and is trusted.
Certificate pinning for android app can be obtained by using a third-party library like OkHttp. When using OkHttp, you need the hostname and the set of hash of public keys of the certificate you trust. The OkHttp client is then instructed to trust only those certificates.
Implementing certificate pinning for Tesco’s Clubcard – a case study
Tesco Clubcard is part of the loyalty programme used by customers at Tesco supermarkets. With Tesco services, each host is pinned with three certificates of which one is Tesco trusted certificate and other two are common for all hosts provided by a third party vendor, Entrust. The common Entrust certificate, which lies on each host, has a longevity of six years or more whereas the Tesco certificate expire after two years. Hence, we give high priority for the Tesco trusted certificate to be validated first. If the initial validation fails (or certificate expires), we then move on to compare the other two certificates and proceed. In case of complete failure, we cancel the handshake.
Overcoming certificate pinning of Clubcard with iOS
Despite Clubcard being compatible with iOS 8, we had multiple condition checks in code. Even though this was serving the purpose of pinning, the implementation was not satisfactory.
To overcome this issue, we implemented pinning with TrustKit, the recommended pinning SDK by OWASP (Open Web Application Web Project). With TrustKit, we provide public key hashes of each host in a key value pair format. Once host is called from the app, TrustKit obtain hashes saved in app and compare with the one obtained from server and takes the decision. With an on/off toggle functionality in TrustKit, we can enable or disable pinning within the code if required.
Bittu Davis is software development engineer at Tesco in Bengaluru.
Great Customer Offer – The Economic Times
Big Data Analytics -Taking a Deeper Dive, Financial Express
“Is internal comms about to get interesting?”, PR Moments
Training Gen-Y employees to be leaders by Nick Williams, Human Capital
Madhu Menon – CFO, Tesco HSC Participates In Bloomberg India CFO Summit 2014
We are investing more in tech as digital property is the way forward: Tesco CIO, the Economic Times
Company Encourages Employees to Go Green, The New Indian Express
Business Women Get More Opportunity, DNA
In Pursuit Of Happiness_The Hindu Business Line
The Future of Big Data in Retail, Images Retail
Garden away those corporate woes – Bangalore Mirror
Hackathons Morph Into Recruiting Vehicle, The Hindu
Tesco HSC Steps to Clean Karunashraya Lake, Bangalore | CSR Vision
Is Diversity Your Company’s Most Resounding Mantra? by Anju Sethi, Head, Learning and Development, Tesco HSC | CXOtoday.com
Oh Baby! Why women can’t break the IT ceiling | Bangalore Mirror
Decade-old Tesco captive still strong, Business Standard
Glen Attewell Interviewed On NASSCOM Website’s Face 2 Face Column
IndiaCSR: Tesco HSC Launches Sustainability Initiatives For Greener Future
OUR AIM TO PLANT TREES
Plan to protect dwindling wetlands of Bengaluru
NEW LIFE TO PLANTS IN PARK: Eenadu
In Retail, Domain-specific Skills Must For Effective Customer Servicing – TimesJobs.Com
Cos Now Hire Storytellers to Mentor Staff – The Economic Times
Training The Managers, The Tesco Way – HR Katha
Every Bit Counts – Human Capital
Lay The Foundation of IT With Agile Technology – CIO Review
For Children Of Migrant Worker – Bangalore Mirror
When change is the only constant – Times Ascent
Staying power of the new workplace
From Nottingham To Whitefield, Metro Life – Deccan Herald, October 5, 2015
Tesco HSC Announces Corporate Name Change to Tesco Bengaluru
From Seeing The Dawn Of Windows To Being The Director Of Technology For Tesco, Bengaluru, Vidya Laxman’s Journey – YourStory.com
Expat’s Diary: For Tesco Bengaluru’s HR-Head, ‘Passion’ And ‘Relationship’ Hold The Key To Indian Work Culture: HR Katha
Boss’s Day: Be a leader, not a ‘boss’ – Timesjobs.com
Gender Diversity’s Good, But Where Is It? – CXO Today
5 Ways To Appreciate An Employee – The Economic Times
Technology Consulting – What Does the Future Hold? – Consultants Review
Tesco Bengaluru Partners With Lithium Urban Technologies to offer a pioneering and emission-free transportation experience for its employees
Tesco Bengaluru Partners with Lithium Urban Technologies to offer emission-free transportation employees: India CSR
Eco-friendly Cars: Samyuktha Karnataka
Emission-free Transportation : Eenadu
Tesco, Lithium Urban Joins Hands: Deccan Herald
Tesco Bengaluru opts for green transportation with Lithium: The Times of India
Need to Reassess Traditional Approaches: People Matters
Marathon Mania: The Economic Times
Women techies log on to trendy, soft wear – Bangalore Mirror
How Retail Giant Tesco Handled The e-comm Onslaught – The Hindu BusinessLine
Investment In People Makes Good Sense: CXOToday
Deck the halls – Deccan Herald
Seminar on M-commerce Held – The New Indian Express
Looking inside contemporary application architecture – Silicon India
Employee Volunteering is a key element in Tesco’s CSR efforts
Press Release: Tesco Bengaluru Wins Best Practice in Data Analysis Strategy Award
Tesco keen to work with Indian start-up ecosystem – Business Standard
TechGig: Women Achievers: It is important for women in technology to be seen, heard and leave an impact, says Tesco Bengaluru tech director Vidya Laxman
New Indian Express: Women Had a Blast
Bangalore Mirror: City Team Feeding UK’s Hungry
Economic Times: Whitefield Builds a Kingdom of Its Own
Hindustan Times: Want the job? Here’s why you should ditch the professionally-written CV
IndiaCSR: Tesco Bengaluru celebrates World Environment Day
Silicon India: Making Your Organization the Best Workplace
Company CSR: Tesco Bengaluru Supports Sankara Eye Hospital To Enable 430 Free Eye Surgeries
CSR India: Tesco Bengaluru supports Sankara Eye Hospital to enable 430 free eye surgeries
Tesco Bengaluru Plants 6500 Saplings Together with Local Communities to Increase City’s Green Cover
Prajavani: Tesco’s Tree Plantation Drive
TimesJobs.com: A Fresher’s Guide to The Technology Industry
Press Release: Tesco Bengaluru hosts Technology Day – Ignite 2016
Tesco Bengaluru bets on agile market push
Tesco Bengaluru installs e-toilets in Whitefield
Tesco Bengaluru Extends Maternity Leave to 22 Weeks
Forbes: Big Data At Tesco: Real Time Analytics At The UK Grocery Retail Giant
Human Capital: Technology At The Very Helm!
CSR Mart: Eco-friendly Transportation for Colleagues
Mint: Lithium Urban Tech paves the way for EV revolution in India’s cab market
ETRetail: Dev-ops adoption in retail in India
Human Capital: Creation of Measurable Goals
Press Release: Tesco Bengaluru renews its commitment to serving Tesco shoppers and colleagues at dedicated shared service centre
Outlook Business: Ride to rejuvenate
Be Grateful, Positive And Strong Urges Deepa Malik at 2017 IWD Event
ET CIO: Tesco Labs has up to 50 projects on the go at any one time: Tesco Bengaluru’s Priyadarsanie Ramasubramanian
Deccan Herald: Keeping a close watch
Deccan Chronicle: Corporate sector leads way in implementing new maternity bill
The Statesman: Path of progress
YourStory: Tesco’s Glen Attewell: ‘My father was a weaver, mother worked in textiles, they pushed me to succeed’
Press Release: Tesco Bengaluru appoints Sumit Mitra as CEO
ET Retail: Retail supply chain planning and optimization
Financial Express: Maternity Benefit Bill, 2016: From Anand Mahindra to TeamLease and Paypal: Will this hurt employment of more women? Here’s what they said!
World HR Dairy: Maternity Benefit (Amendment) Bill, 2016 increases paid Maternity Leave to 26 weeks in India | Major Highlights and Industry Reaction
TheDrum: Apple, Google, Lego, Tesco and BMW top UK’s most loved brands on social media
Economic Times: Bye-bye corner office: It’s one team, one space
Press Release: Tesco Bengaluru reinforces commitment to sustainable practices through World Environment Day activities
Business World: We Go Beyond The Mandated 2% For CSR: Aniisu Verghese, Tesco
Economic Times: Here is how companies are learning from millennials’ mistakes
Deccan Herald: Rise of AI redefining retail
Financial Express: Tesco Bengaluru CEO Sumit Mitra: We believe in driving a culture of innovation
Economic Times: 5 ways to delegate decision making
The Economic Times: To bridge gender gap, companies going big on innovation
Dr. Sumit Mitra wins ‘CEO of the Year’ at the Future Leaders Summit and Award 2018
Tesco in Bengaluru collaborates with Indian Institute of Science for a technology fellowship programme
Tesco Leaders at NASSCOM Product Conclave 2018
Securing mobile apps – Preventing MiM attack
Bengaluru goes from technology capital to talent hub as e-tailers hunt for IT skills
Tesco establishes a Business Services Centre in Budapest to serve its Central European operations
How to make an organisation an awesome place to work
We are a Great Place To Work® certified organisation.
Applied data scientists – A natural evolution for software engineers?
Tesco Business Services – UK Receives Process Improvement Award at the Engage 19
Tesco collaborates with NASSCOM Foundation to set up its first Nook in Bengaluru
Tesco, Nasscom to improve employability
My First Job: Sumit Mitra,CEO, Tesco Global Business Services
Read interview of Sumit Mitra; he is CEO of TESCO Global Business Services
Shiva Chinnasamy of Tesco on the evolving role of a technology leader
Top 5 Key Skills A Good Data Scientist Should Have
Bengaluru is central to how we run Tesco, says CEO Dave Lewis
Dr. Sumit Mitra – CEO, Tesco Business Services & Tesco Bengaluru is now on Confederation of British Industry (CBI) advisory board for India
NASSCOM Leader Talk: Interview with Dr. Sumit Mitra, CEO – Tesco Business Services & Tesco Bengaluru
Business Today: Tesco Bengaluru Helps Over 320 Underprivileged Youth Stand Tall Through Life Skills and Vocational Training and Job Placements.
TimesJobs.com: Leader’s talk: Sumit Mitra, CEO, Tesco Business Services
Economic Times: Develop The Habit of Collaboration
Entrepreneur India: Make Your Employees Feel Like the Founder
Tesco announces launch of community-based clean water programme in rural Bengaluru
Entrepreneur.com: Why Innovation in Hiring Has Become the Need of the Hour
Tesco Bengaluru appoints Sumit Mitra as CEO
Tesco Bengaluru reinforces commitment to sustainable practices through World Environment Day activities
Tesco Bengaluru renews its commitment to serving Tesco shoppers and colleagues at dedicated shared service centre
Tesco Bengaluru hosts Technology Day – Ignite 2016
Tesco Bengaluru Wins Best Practice in Data Analysis Strategy Award
Economic Times: Companies go liberal in giving time off to new dads
Analytics India: How Tesco Bengaluru Is Working On Using AI, VR And 3D Modelling In Retail Industry
Tesco Bengaluru Participates in Women – Only Hackathon
Tesco Bengaluru inaugurates first community career development Centre in partnerhsip with NASSCOM Foundation
Delivering The Most Compelling Offer For Customers
Tesco Business Services is recognised as one of the top 20 Most Admired Shared Services Organisations in the World by SSON
Waste food to Plant Wealth: Tesco helps farmers with compost
Sustainability Practices at Tesco
Business services of the future: More digital, more intelligent
How Bengaluru kept UK’s Tesco retail ops going during Covid-19
Vidya Laxman, Director, Tesco Technology: A bag full of opportunities will soon overflow with AI
Refuelling India’s Tech Economy
Top skills companies will look for in the post COVID era
How Analytics Is Shaping The Retail Industry In India
BCP PlayBook: Tesco put people at the heart of its COVID-19 resilience plan
Tesco Business Services receives four awards at the ‘Impact Annual Awards Asia 2020’ organized by Shared Services & Outsourcing Network (SSON)
Tesco Bengaluru appoints Ramamoorthy Rajagopal as Finance Director
Tesco Bengaluru Appoints Nimmi Sebastian as Head of Communication & CSR
Despite Covid, Bangalore helps Tesco engineer a success story: An Economic Times Coverage
How analytics helped Tesco improve its customer satisfaction amid Covid: An Economic Times Coverage
Three years in a row, Tesco Business Services recognised as one of the Top 20 Most Admired Shared Services Organizations in the World by SSON
Tesco has moved from being service-led to an engineering-based firm: CEO
Data insights helped boost revenues for these three large corporates
How Tesco Bengaluru transformed Tesco’s retail experience in UK
Women at the new workplace: WFH to Hybrid models – post-pandemic world to witness radical reforms