Introduction Breaking best practice protection of the TLS protocol in an Android environment 2020-05-11 Version 1.0 Author Supervisor C.A.L. Mandjes F. de Korte Master student Radboud University Northwave Red team
[email protected] [email protected] Supervisor Second reader Prof. dr. E. Verheul Dr. ir. E. Poll Radboud University Radboud University
[email protected] [email protected] 1 Introduction Abstract Northwave’s Red team performs penetration testing on Android applications for its customers. As part of this test, the tester analyzes the data which is being transmitted between the application and its backend server. However, many applications are using the Transport Layer Security (TLS) protocol, which is an encryption protocol, with the certificate pinning technique implemented. In order to set up a man-in-the-middle attack, Northwave was using a tool called the Android-SSL-Trustkiller. This tool disables the certificate pinning technique so that a man- in-the-middle position can be deployed. However, the Android-SSL-Trustkiller is not working when the targeted Android application is using the SafetyNet Attestation service. Therefore, the goal of this research project is to find a new way to break the protection of the data sent in a TLS session, with certificate pinning and SafetyNet Attestation service implemented, in an Android environment. The SafetyNet Attestation service is an anti-abuse system that focusses on the integrity of the Android application and the Android device which it is running on. As part of the integrity checks on the Android device, it can detect whether a device is rooted.