Cybersecurity professionals know what they’re up against.
The type, number and severity of cyberattacks grows with time. Hackers display no shortage of cunning and ingenuity in exploiting security vulnerabilities, compromising important data and inflicting damage to both individuals and organizations.
Cybersecurity professionals also know that their defenses must evolve along with the attacks, requiring them to display even more ingenuity than hackers when creating security tools. They also need to pile those tools on top of one another in order (depth in defense) to make life as difficult as possible for hackers.
TLS Certificates
One such security precaution is the issuance of transport layer security (TLS) certificates by trusted Certificate Authorities (CAs). While the main purpose of TLS pinning is identity assurance, TLS also provides confidentiality and integrity of data using PKI, which can improve assurance of the identity of the endpoint. After verifying the website server’s identity, the certificates create encrypted channels of communication between that server and visitors.
Unsurprisingly, hackers have devised workarounds to these certificates, even going as far as buying and selling forged TLS certificates on the dark web. The mere existence of a TLS certificate is no longer enough to guarantee secure internet communication between web servers and clients.
To stay ahead of hackers, the arms race continues.
One such additional measure is known as TLS pinning, which offers an additional layer of security that meshes nicely with what the certificate issuance system already does.
Given the growing severity of cyberattacks on mobile devices and platforms, here’s what TLS pinning means for mobile users and how it affects the downloading of new mobile apps.
What TLS Certificates do and How They Work
TLS certificates work through the “magic” of public key encryption.
The central principle behind public key encryption is that two parties, A and B, who wish to send messages to one another without any third party, C, reading their messages can best do so if each has both a public and a private key that they can use to encrypt and decrypt messages.
The public key encryption process allows A to craft a message for B and use their public key — which is available to the public — to turn that message into encrypted gibberish. The only thing that will be able to turn the gibberish back into the original message is B’s private key, which only B has access to.
As long as B doesn't lose their private key and keeps others from stealing it, it won’t matter if C is able to intercept and read A’s message to B. It will be unreadable to anyone but B. The same is true for any message that B sends to A. B encrypts their message with their public key and only A’s private key will be able to decrypt it.
HTTPS is the TLS Highway
TLS certificates allow web servers to securely communicate with clients protected by public key encryption. Hypertext Transfer Protocol (HTTP) is the standard communication protocol on the internet and Hypertext Transfer Protocol Secure (HTTPS) is the version that uses public key encryption. In HTTPS, communication is secured through a series of “handshakes” between the client and the server.
It works like this. The client first sends an initial data packet to the server, which responds with its TLS certificate. The client checks with the appropriate CA that the certificate is genuine. Once this check is complete, public and private keys are generated for the server and client and they commence encrypted communications. You can find a more detailed overview of the TLS handshake here.
TLS Pinning
TLS pinning adds a layer of security on top of everything. You may have noticed in the preceding scenario that it seems to be taken as a given that any CA with which the client performs a check is considered authoritative. However, how do we know that the CA with which the client checks a TLS certificate is genuine and reputable?
That is precisely the problem that TLS pinning is intended to address. Depending on the kind of pinning used, clients can be either pre-configured to expect a certain type of certificate from a given CA (“hard certificate pinning”) or will have a list of CAs whose certificates they accept as valid (“CA pinning”).
Before the handshake is carried out, the client checks whether the certificates are of the expected type or come from a valid CA. If not, then the client either automatically terminates the connection with the server or at least presents you with a warning to this effect before giving you the option to either proceed or terminate the connection.
How this Applies to Mobile Apps
The mobile app stores run by Apple and Google generally have stringent security checks designed to make sure that the apps they offer to customers are secured. Occasionally, however, infected apps make it through the screening process. In such cases, it’s possible for hackers to intercept data transmitted from your phone to the server of the mobile app you’re using.
For an idea of how catastrophic this might be, imagine if it happened as you were using a banking app and suddenly your account login credentials were stolen.
The public key encryption used in HTTPS connections brokered by TLS certificates are meant to prevent this kind of thing by verifying the legitimacy of certain CAs in the mobile situation.
Some apps are not sold in established stores. Developers might offer them to the public in their own venues. Downloading apps like this presents added danger — since you don’t know whether the app is secure or if the developer can be trusted — and TLS pinning is crucial to establishing trust in such situations.
If the typical security provisions that come with downloading a mobile app from a reputable app store don’t exist, app developers can include TLS to beef up security from their own end.
Pushing security yet further
Keep in mind that even the greater level of security that TLS pinning provides may not be enough to fully protect you from unwanted snooping. According to a recent study by Bruce Schneier, there are still exploitable security vulnerabilities.
One way to address TLS pinning shortcomings is with virtual private network (VPN) technology, which works in conjunction with your ISP to add another layer of encryption to the connection created after a TLS handshake. VPN services range in strength and security, with some able to protect major enterprise networks and others built for the average Joe and Jane looking to stream their favorite Netflix show.
Another popular VPN feature has gained notoriety for circumventing geo-restrictions put in place by online streaming services like Netflix. It provides anonymity by running your traffic through one of their own servers, which can be located anywhere. This effectively hides your IP address from bad guys looking to trace your tracks. They will run into a “brick wall” at the door of the VPN server, preventing them from finding your actual location.
Though a novelty a few short years ago, a casual glance at third party VPN reviews demonstrates how cybersecurity best practices are important to protect our apps in our everyday lives.
Final Thoughts
Hackers are an industrious bunch, dedicated to their criminal craft, churning away as they try to steal your personal data in a variety of creative ways. The near ubiquity of smartphones and other mobile devices these days makes them an especially attractive target. The TLS pinning protocol is one effective way to beef up security.
Don’t become complacent. Opportunities for cybercrime are everywhere. Vulnerabilities can suddenly appear in technologies heretofore considered solid. Even if you’re not a cybersecurity pro, reading an industry blog or two regularly is a good idea to at least stay aware of where the new threats are coming from.
Note from the editor: this blog reflects the perspective and opinions of a guest blogger, not AT&T.