News

Securing mobile apps – Preventing MiM attack

January 11, 2019

Here are a few ways to prevent Man In the Middle attacks in iOS and Android platforms by implementing certificate pinning as a security measure.

A key differentiator of successful mobile apps today is that they provide contextual, relevant and personalized information to their users.  As the apps capture personal data like email and location, developers now have a larger role to play in enabling secure data transmission and use.

Here are a few ways to prevent Man In the Middle (MiM) attacks in iOS and Android platforms by implementing certificate pinning as a security measure.

What is MiM?

A man-in-the-middle (MiM) attack is a cyberattack where a malicious actor inserts him/herself into a conversation between two parties, impersonates both parties and gains access to information that the two parties were trying to send to each other.

Why do we need certificate pinning?

MiM attacker can impersonate the actual service and thereby take complete control of the application. It is here that certificate pinning is introduced to minimize opportunities for gaining wrongful access to the service.

When should certificate pinning be deployed?

While keeping user information secure is vital to any application, certificate pinning is essential for apps that handle sensitive user data like email address, credit card information or some related data over network which can alter reputation of an individual.

Certificate pinning in iOS

Certificate pinning in iOS can be achieved by using Security Framework or by any third-party software developer’s kits like TrustKit.

Security framework provides two methods for pinning:

In the first case, the actual certificate is bundled into an app. When user information is loaded, the software matches it with the data in the certificate, which is obtained from the server. The programme proceeds only if the comparison is successful – else, it fails to establish the connection.  Certificates are issued by secure hosting providers. It is obtained by placing a request or by enquiring with ssllabs.com. One way in which iOS implements certificate pinning is by copying these files to the application bundle and then perform the validation while application is running.

In the second method, public key hashes are saved within the app. They are then extracted from server certificates. The
program then proceeds in the same manner as the first case.

In case of iOS app, pinning with public key hashes with multiple certificates for same host was available only from iOS 10 as per built in Security Framework by Apple.

Securing an Android App

To prevent Man in the Middle Attack, an Android app trusts all pre-installed certificate authorities. However, apps have the freedom to choose the certificate pinning. If a certificate is one of the public keys provided, it is considered valid and is trusted.

Certificate pinning for android app can be obtained by using a third-party library like OkHttp. When using OkHttp, you need the hostname and the set of hash of public keys of the certificate you trust. The OkHttp client is then instructed to trust only those certificates.

Implementing certificate pinning for Tesco’s Clubcard – a case study 

Tesco Clubcard is part of the loyalty programme used by customers at Tesco supermarkets. With Tesco services, each host is pinned with three certificates of which one is Tesco trusted certificate and other two are common for all hosts provided by a third party vendor, Entrust. The common Entrust certificate, which lies on each host, has a longevity of six years or more whereas the Tesco certificate expire after two years. Hence, we give high priority for the Tesco trusted certificate to be validated first. If the initial validation fails (or certificate expires), we then move on to compare the other two certificates and proceed. In case of complete failure, we cancel the handshake.

Overcoming certificate pinning of Clubcard with iOS

Despite Clubcard being compatible with iOS 8, we had multiple condition checks in code. Even though this was serving the purpose of pinning, the implementation was not satisfactory.

To overcome this issue, we implemented pinning with TrustKit, the recommended pinning SDK by OWASP (Open Web Application Web Project). With TrustKit, we provide public key hashes of each host in a key value pair format. Once host is called from the app, TrustKit obtain hashes saved in app and compare with the one obtained from server and takes the decision. With an on/off toggle functionality in TrustKit, we can enable or disable pinning within the code if required.

Bittu Davis is software development engineer at Tesco in Bengaluru.

You May also like...

Great Customer Offer – The Economic Times

Big Data Analytics -Taking a Deeper Dive, Financial Express

“Is internal comms about to get interesting?”, PR Moments

Training Gen-Y employees to be leaders by Nick Williams, Human Capital

Madhu Menon – CFO, Tesco HSC Participates In Bloomberg India CFO Summit 2014

We are investing more in tech as digital property is the way forward: Tesco CIO, the Economic Times

Company Encourages Employees to Go Green, The New Indian Express

Business Women Get More Opportunity, DNA

In Pursuit Of Happiness_The Hindu Business Line

The Future of Big Data in Retail, Images Retail

Garden away those corporate woes – Bangalore Mirror

Hackathons Morph Into Recruiting Vehicle, The Hindu

Tesco HSC Steps to Clean Karunashraya Lake, Bangalore | CSR Vision

Is Diversity Your Company’s Most Resounding Mantra? by Anju Sethi, Head, Learning and Development, Tesco HSC | CXOtoday.com

Oh Baby! Why women can’t break the IT ceiling | Bangalore Mirror

Decade-old Tesco captive still strong, Business Standard

Glen Attewell Interviewed On NASSCOM Website’s Face 2 Face Column

IndiaCSR: Tesco HSC Launches Sustainability Initiatives For Greener Future

OUR AIM TO PLANT TREES

Plan to protect dwindling wetlands of Bengaluru

NEW LIFE TO PLANTS IN PARK: Eenadu

In Retail, Domain-specific Skills Must For Effective Customer Servicing – TimesJobs.Com

Cos Now Hire Storytellers to Mentor Staff – The Economic Times

Training The Managers, The Tesco Way – HR Katha

Every Bit Counts – Human Capital

Lay The Foundation of IT With Agile Technology – CIO Review

For Children Of Migrant Worker – Bangalore Mirror

When change is the only constant – Times Ascent

Staying power of the new workplace

From Nottingham To Whitefield, Metro Life – Deccan Herald, October 5, 2015

Tesco HSC Announces Corporate Name Change to Tesco Bengaluru

From Seeing The Dawn Of Windows To Being The Director Of Technology For Tesco, Bengaluru, Vidya Laxman’s Journey – YourStory.com

Expat’s Diary: For Tesco Bengaluru’s HR-Head, ‘Passion’ And ‘Relationship’ Hold The Key To Indian Work Culture: HR Katha

Boss’s Day: Be a leader, not a ‘boss’ – Timesjobs.com

Gender Diversity’s Good, But Where Is It? – CXO Today

5 Ways To Appreciate An Employee – The Economic Times

Technology Consulting – What Does the Future Hold? – Consultants Review

Tesco Bengaluru Partners With Lithium Urban Technologies to offer a pioneering and emission-free transportation experience for its employees

Tesco Bengaluru Partners with Lithium Urban Technologies to offer emission-free transportation employees: India CSR

Eco-friendly Cars: Samyuktha Karnataka

Emission-free Transportation : Eenadu

Tesco, Lithium Urban Joins Hands: Deccan Herald

Tesco Bengaluru opts for green transportation with Lithium: The Times of India

Need to Reassess Traditional Approaches: People Matters

Marathon Mania: The Economic Times

Women techies log on to trendy, soft wear – Bangalore Mirror

How Retail Giant Tesco Handled The e-comm Onslaught – The Hindu BusinessLine

Investment In People Makes Good Sense: CXOToday

Deck the halls – Deccan Herald

Seminar on M-commerce Held – The New Indian Express

Staying power of the new workplace

Looking inside contemporary application architecture – Silicon India

Employee Volunteering is a key element in Tesco’s CSR efforts

Press Release: Tesco Bengaluru Wins Best Practice in Data Analysis Strategy Award

Tesco keen to work with Indian start-up ecosystem – Business Standard

TechGig: Women Achievers: It is important for women in technology to be seen, heard and leave an impact, says Tesco Bengaluru tech director Vidya Laxman

New Indian Express: Women Had a Blast

Bangalore Mirror: City Team Feeding UK’s Hungry

Economic Times: Whitefield Builds a Kingdom of Its Own

Hindustan Times: Want the job? Here’s why you should ditch the professionally-written CV

IndiaCSR: Tesco Bengaluru celebrates World Environment Day

Silicon India: Making Your Organization the Best Workplace

Company CSR: Tesco Bengaluru Supports Sankara Eye Hospital To Enable 430 Free Eye Surgeries

CSR India: Tesco Bengaluru supports Sankara Eye Hospital to enable 430 free eye surgeries

Tesco Bengaluru Plants 6500 Saplings Together with Local Communities to Increase City’s Green Cover

Prajavani: Tesco’s Tree Plantation Drive

TimesJobs.com: A Fresher’s Guide to The Technology Industry

Press Release: Tesco Bengaluru hosts Technology Day – Ignite 2016

Tesco Bengaluru bets on agile market push

Tesco Bengaluru installs e-toilets in Whitefield

Tesco Bengaluru Extends Maternity Leave to 22 Weeks

Forbes: Big Data At Tesco: Real Time Analytics At The UK Grocery Retail Giant

Human Capital: Technology At The Very Helm!

CSR Mart: Eco-friendly Transportation for Colleagues

Mint: Lithium Urban Tech paves the way for EV revolution in India’s cab market

ETRetail: Dev-ops adoption in retail in India

Human Capital: Creation of Measurable Goals

Press Release: Tesco Bengaluru renews its commitment to serving Tesco shoppers and colleagues at dedicated shared service centre

Outlook Business: Ride to rejuvenate

Be Grateful, Positive And Strong Urges Deepa Malik at 2017 IWD Event

ET CIO: Tesco Labs has up to 50 projects on the go at any one time: Tesco Bengaluru’s Priyadarsanie Ramasubramanian

Deccan Herald: Keeping a close watch

Deccan Chronicle: Corporate sector leads way in implementing new maternity bill

The Statesman: Path of progress

YourStory: Tesco’s Glen Attewell: ‘My father was a weaver, mother worked in textiles, they pushed me to succeed’

Press Release: Tesco Bengaluru appoints Sumit Mitra as CEO

ET Retail: Retail supply chain planning and optimization

Financial Express: Maternity Benefit Bill, 2016: From Anand Mahindra to TeamLease and Paypal: Will this hurt employment of more women? Here’s what they said!

World HR Dairy: Maternity Benefit (Amendment) Bill, 2016 increases paid Maternity Leave to 26 weeks in India | Major Highlights and Industry Reaction

TheDrum: Apple, Google, Lego, Tesco and BMW top UK’s most loved brands on social media

Economic Times: Bye-bye corner office: It’s one team, one space

Press Release: Tesco Bengaluru reinforces commitment to sustainable practices through World Environment Day activities

Business World: We Go Beyond The Mandated 2% For CSR: Aniisu Verghese, Tesco

Economic Times: Here is how companies are learning from millennials’ mistakes

Deccan Herald: Rise of AI redefining retail

Financial Express: Tesco Bengaluru CEO Sumit Mitra: We believe in driving a culture of innovation

Economic Times: 5 ways to delegate decision making

The Economic Times: To bridge gender gap, companies going big on innovation

Dr. Sumit Mitra wins ‘CEO of the Year’ at the Future Leaders Summit and Award 2018

Tesco in Bengaluru collaborates with Indian Institute of Science for a technology fellowship programme

Tesco Leaders at NASSCOM Product Conclave 2018

Securing mobile apps – Preventing MiM attack

Bengaluru goes from technology capital to talent hub as e-tailers hunt for IT skills

Tesco establishes a Business Services Centre in Budapest to serve its Central European operations

How to make an organisation an awesome place to work

We are a Great Place To Work® certified organisation.

Applied data scientists – A natural evolution for software engineers?

Tesco Business Services – UK Receives Process Improvement Award at the Engage 19

Tesco establishes a Business Services Centre in Budapest to serve its Central European operations

Tesco collaborates with NASSCOM Foundation to set up its first Nook in Bengaluru

Tesco, Nasscom to improve employability

My First Job: Sumit Mitra,CEO, Tesco Global Business Services

Read interview of Sumit Mitra; he is CEO of TESCO Global Business Services

Shiva Chinnasamy of Tesco on the evolving role of a technology leader

Top 5 Key Skills A Good Data Scientist Should Have

Bengaluru is central to how we run Tesco, says CEO Dave Lewis

Dr. Sumit Mitra – CEO, Tesco Business Services & Tesco Bengaluru is now on Confederation of British Industry (CBI) advisory board for India

NASSCOM Leader Talk: Interview with Dr. Sumit Mitra, CEO – Tesco Business Services & Tesco Bengaluru

Business Today: Tesco Bengaluru Helps Over 320 Underprivileged Youth Stand Tall Through Life Skills and Vocational Training and Job Placements.

TimesJobs.com: Leader’s talk: Sumit Mitra, CEO, Tesco Business Services

Economic Times: Develop The Habit of Collaboration

Entrepreneur India: Make Your Employees Feel Like the Founder

Tesco announces launch of community-based clean water programme in rural Bengaluru

Entrepreneur.com: Why Innovation in Hiring Has Become the Need of the Hour

Dr. Sumit Mitra wins ‘CEO of the Year’ at the Future Leaders Summit and Award 2018

Tesco Bengaluru appoints Sumit Mitra as CEO

Tesco Bengaluru reinforces commitment to sustainable practices through World Environment Day activities

Tesco Bengaluru renews its commitment to serving Tesco shoppers and colleagues at dedicated shared service centre

Tesco Bengaluru hosts Technology Day – Ignite 2016

Tesco Bengaluru Wins Best Practice in Data Analysis Strategy Award

Tesco HSC Announces Corporate Name Change to Tesco Bengaluru

Economic Times: Companies go liberal in giving time off to new dads

Analytics India: How Tesco Bengaluru Is Working On Using AI, VR And 3D Modelling In Retail Industry

Tesco Bengaluru Participates in Women – Only Hackathon

Dr. Sumit Mitra wins ‘CEO of the Year’ at the Future Leaders Summit and Award 2018

Tesco Bengaluru inaugurates first community career development Centre in partnerhsip with NASSCOM Foundation

Delivering The Most Compelling Offer For Customers

Tesco Business Services is recognised as one of the top 20 Most Admired Shared Services Organisations in the World by SSON

Waste food to Plant Wealth: Tesco helps farmers with compost

Sustainability Practices at Tesco

Business services of the future: More digital, more intelligent

How Bengaluru kept UK’s Tesco retail ops going during Covid-19

Vidya Laxman, Director, Tesco Technology: A bag full of opportunities will soon overflow with AI

Refuelling India’s Tech Economy

Top skills companies will look for in the post COVID era

How Analytics Is Shaping The Retail Industry In India

BCP PlayBook: Tesco put people at the heart of its COVID-19 resilience plan

Staying power of the new workplace

Tesco Business Services receives four awards at the ‘Impact Annual Awards Asia 2020’ organized by Shared Services & Outsourcing Network (SSON)

Tesco Bengaluru appoints Ramamoorthy Rajagopal as Finance Director

Tesco Bengaluru Appoints Nimmi Sebastian as Head of Communication & CSR

Despite Covid, Bangalore helps Tesco engineer a success story: An Economic Times Coverage

How analytics helped Tesco improve its customer satisfaction amid Covid: An Economic Times Coverage

Three years in a row, Tesco Business Services recognised as one of the Top 20 Most Admired Shared Services Organizations in the World by SSON