A penetration tester is assessing a mobile banking application. Man-in-the-middle attempts via a HTTP intercepting proxy are failing with SSL errors. Which of the following controls has likely been…

The correct answer is B. SSL certificate pinning. SSL certificate pinning (B) is a technique where the mobile application has the expected server certificate (or its public key hash) hard-coded or bundled inside the app. When an intercepting proxy (e.g., Burp Suite, Charles) inserts its own certificate to perform a MITM…

Enterprise Security

Question

A penetration tester is assessing a mobile banking application. Man-in-the-middle attempts via a HTTP intercepting proxy are failing with SSL errors. Which of the following controls has likely been implemented by the developers?

Options

ASSL certificate revocation
BSSL certificate pinning
CMobile device root-kit detection
DExtended Validation certificates

How the community answered

(53 responses)

A
8% (4)
B
87% (46)
C
4% (2)
D
2% (1)

Explanation

SSL certificate pinning (B) is a technique where the mobile application has the expected server certificate (or its public key hash) hard-coded or bundled inside the app. When an intercepting proxy (e.g., Burp Suite, Charles) inserts its own certificate to perform a MITM attack, the app compares the presented certificate against the pinned value, finds a mismatch, and terminates the TLS handshake with an SSL error. SSL certificate revocation (A) checks whether a certificate has been revoked by its CA but does not prevent MITM by a proxy that presents a different certificate. Rootkit detection (C) looks for device compromise indicators, not certificate validation. Extended Validation certificates (D) provide additional identity assurance in browsers but do not prevent a proxy from substituting its own certificate.

Topics

#SSL certificate pinning#mobile security#MITM prevention#TLS

Community Discussion

No community discussion yet for this question.

Full CAS-001 Practice