NowSecure

We deliver mobile app security testing, incident response, and compliance solutions.

Main navigation

certificate pinning

certificate pinning and hostname verification

Certificate Pinning and Hostname Verification: Don’t Get Pinned by a Mobile Man-In-The-Middle Attack

Recent news stories have brought attention to a research paper (“Spinner: Semi-Automatic Detection of Pinning without Hostname Verification”) published this week highlighting man-in-the-middle (MITM) vulnerabilities in a number of public mobile apps. The vulnerability springs from a failure to validate that the hostname on the certificate matches the actual host to which an app connects.

Read Now >

Certificate pinning for Android & iOS: Man-in-the-Middle Attack Prevention

Certificate pinning for Android and iOS: Mobile man-in-the-middle attack prevention

Implementing certificate pinning in mobile apps that handle highly sensitive data provides too much benefit to be passed over. Users can be tricked into installing a malicious self-signed certificate on a mobile device, setting the stage for a man-in-the-middle attack.  In those situations, certificate pinning can still prevent the interception of an app’s network traffic.

Read Now >