Man-in-the-Middle
Full API visibility on banking channels.
Threat Intelligence
SSL Certificate Pinning & TLS Integrity
Severity: criticalNetwork InterceptionAPI Communications
Affected: Mobile Banking · Open Banking · Payments · Wallets
Threat IntelligenceNetwork MITMAPI SecurityMASVS-NETWORK
Without certificate or public-key pinning, attackers intercept HTTPS traffic using rogue CAs, corporate proxies, or Frida SSL-kill-switch — exposing tokens, PII, and transaction payloads.
Low
Attack Complexity
With rooted device + proxy
8.8/10
Exploitability
Well-documented tooling
Critical
Fraud Risk
Session + API theft
High
Regulatory Impact
MASVS L2 requirement
Attack chain
Typical exploitation path in mobile banking
1Rogue CA
2MITM proxy
3TLS terminate
4Token steal
5API replay
Kill Chain
How this attack happens
End-to-end attack timeline observed in mobile banking incidents.
Step 1
Network position
Attacker on same Wi-Fi or controls DNS/proxy.
Step 2
Rogue CA installed
User installs attacker CA or uses rooted trust store.
Step 3
TLS interception
Proxy terminates TLS — sees plaintext API calls.
Step 4
Token extraction
Bearer tokens, refresh tokens and cookies stolen.
Step 5
Session replay
Attacker replays authenticated API calls from another host.
Business Impact
Impact on financial institutions
Operational, financial and regulatory consequences for BFSI.
Estimated severity
critical
Session Token Theft
Long-lived tokens enable persistent ATO.
Transaction Data Exposure
Balances, payees and amounts visible in transit.
Regulatory Findings
MASVS-NETWORK and PCI DSS transmission failures.
Open Banking Risk
Third-party API credentials exposed.
SOC Intelligence
Observed risk signals
Typical APK assessment findings mapped to this threat.
critical
Certificate pinning not implemented
No pin on auth or payment API hosts.
high
Trust-all certificate manager
Custom TrustManager accepts any cert.
high
Cleartext traffic allowed
usesCleartextTraffic or HTTP endpoints.
medium
No backup pins configured
Cert rotation will break app or force pin removal.
low
Pinning only on login API
Payment APIs unprotected.
Detection
How MobAIsec detects this threat
Four-phase governance pipeline — deterministic evidence only.
Phase 1
Static Analysis
- ›CertificatePinner / TrustKit usage
- ›network_security_config audit
- ›Hardcoded pin hashes
Phase 2
Runtime Intelligence
- ›TLS stack fingerprinting
- ›Proxy detection
- ›Frida SSL bypass surface
Phase 3
Governance Mapping
- ›MASVS-NETWORK-2
- ›OWASP M5
- ›PCI DSS Req 4
Phase 4
Evidence Collection
- ›Endpoint-level pin coverage map
- ›Cleartext URL enumeration
Static Analysis→Runtime Intelligence→Governance Mapping→Evidence Collection
Mitigation
Recommended banking controls
Layered defenses with coverage, effort and effectiveness ratings.
Public Key Pinning
Coverage: Very HighProtects: MITM on banking APIs
Effort
Medium
Effectiveness
90%
Pin SPKI hashes; maintain backup pins for rotation.
Network Security Config
Coverage: HighProtects: Cleartext blocking
Effort
Low
Effectiveness
85%
Android NSC must disallow cleartext in production.
Approov / API Shield
Coverage: Very HighProtects: Runtime cert + app attestation
Effort
High
Effectiveness
93%
Strong for open banking and high-value APIs.
Certificate Transparency
Coverage: MediumProtects: Fraudulent cert detection
Effort
Medium
Effectiveness
65%
Server-side complement to client pinning.
Regulatory Intel
Banking regulations requiring this protection
Compliance confidence and mapped control counts per jurisdiction.
UAE
CBUAE
Compliance confidence94%
12 mapped controls
View mandate →India
RBI
Compliance confidence88%
9 mapped controls
View mandate →Singapore
MAS
Compliance confidence96%
11 mapped controls
View mandate →EU
EBA / PSD2
Compliance confidence91%
10 mapped controls
View mandate →United States
FFIEC
Compliance confidence85%
8 mapped controls
View mandate →Framework Alignment
Security framework alignment
How this threat maps across MASVS, OWASP Mobile, PCI DSS, PSD2, NIST and DORA.
| Control | MASVS | OWASP Mobile | PCI DSS | PSD2 | NIST | DORA |
|---|---|---|---|---|---|---|
| Certificate pinning | ● | ● | ◐ | ◐ | ● | ◐ |
| TLS 1.2+ | ● | ● | ● | ● | ● | ● |
| No cleartext | ● | ● | ● | ● | ● | ● |
| Session binding | ◐ | ◐ | ● | ● | ● | ● |
Executive Summary
Executive risk summary
Board-ready risk dimensions and impact heatmap.
Lower = higher residual risk
Likelihood85%
Impact90%
Exploitability88%
Compliance Risk80%
Impact heatmap
MITM
L: 88%
I: 92%
Token theft
L: 82%
I: 90%
API abuse
L: 75%
I: 88%
PII exposure
L: 80%
I: 85%
Financial loss
L: 70%
I: 90%
Vendor Intel
Enterprise protection vendors
RASP, attestation and device-trust solutions for banking programs.
OkHttp CertificatePinner
Native Android pinning
Platform / Free
Banking: baseline
Pros
- + Built-in
- + Well documented
Limitations
- − Bypassable with Frida
TrustKit
Cross-platform pinning
Mid-market
Banking: good
Pros
- + iOS + Android
- + Reporting
Limitations
- − Requires maintenance
Approov
Strong API integrity
Enterprise
Banking: excellent
Pros
- + Runtime attestation
- + Certificate pinning as a service
Limitations
- − Less native UI protection
Zimperium
Mobile threat defense
Enterprise
Banking: good
Pros
- + On-device threat intel
- + MDM integration
Limitations
- − Complex deployment
APK Preview
APK threat intelligence preview
Sample assessment output for SSL Pinning exposure.
Risk score
28
/ 100
2 critical findings
Observed risks
- ✗Pinning missing on payment API
- ✗Cleartext analytics endpoint
- ✗Trust-all SSL context
Mapped controls
MASVS-NETWORKOWASP M5PCI DSS R4
Upload APK to validate →Related Intel
Related intelligence
Related threats
Adjacent attack patterns
Related frameworks
Governance standards
FAQ
Threat intelligence FAQ
SEO-optimized answers for security and governance teams.
Is SSL pinning required for banking apps?
Yes — MASVS L2 and most banking regulators require certificate or public-key pinning for API communications beyond standard TLS.
Can Frida bypass SSL pinning?
Frida scripts (ssl-kill-switch2) hook SSL verification methods. Pinning must be combined with RASP and runtime integrity checks.
What is certificate pinning vs public key pinning?
Certificate pinning pins the entire cert; public key pinning pins the SPKI hash and survives cert renewal if the same key is used.
How does MobAIsec detect missing pinning?
Static analysis maps TLS stacks, pin configurations, and cleartext endpoints per API host with evidence artifacts.
Take action
Validate your banking APK against SSL Pinning
Upload your Android banking app for evidence-backed threat intelligence — no hallucinated findings.
- ✓Threat exposure score
- ✓Runtime hardening analysis
- ✓Banking compliance mapping
- ✓Fraud readiness score
- ✓Executive PDF report
- ✓Remediation guidance