An attacker performed a MITM attack against a mobile application. The attacker is attempting to manipulate the application's network traffic via a proxy tool. The attacker only sees limited traffic as cleartext. The application log files indicate secure SSL/TLS connections are failing. Which of the following is MOST likely preventing proxying of all traffic?

Question

Accepted Answer

B. Certificate pinning Certificate pinning embeds the server's expected certificate or public key directly into the application at compile time. When a proxy tool presents its own certificate to intercept HTTPS traffic, the application compares it against the pinned value and rejects the connection, causing SSL/TLS handshake failures. This explains why only limited traffic appears as cleartext - connections that do not use pinning are proxied successfully, while pinned connections fail.

Answer

A. Misconfigured routes Misconfigured routes would prevent traffic from reaching the proxy entirely rather than causing selective SSL/TLS handshake failures for specific connections.

Answer

C. Strong cipher suites Strong cipher suites affect encryption strength but do not prevent a proxy from intercepting and re-encrypting traffic or cause certificate-related rejection errors.

Answer

D. Closed ports Closed ports would block all connections to specific services entirely, not produce partial cleartext visibility alongside SSL/TLS failures.

An attacker performed a MITM attack against a mobile application. The attacker is attempting to manipulate the application's network traffic via a proxy tool. The attacker only sees limited traffic…

Question

Options

How the community answered

Why each option

Topics

Community Discussion