Kasikornbank Mar 24, 2021

Mobile Security via Flutter — Ep.1 SSL Pinning

M5 Related OWASP risk: Insecure Communication Learn more →

Article Summary

Amorn Apichattanakul from KBTG reveals why the SSL pinning solution most Flutter devs find on StackOverflow has a critical security flaw. His team discovered this while building banking apps that passed penetration testing.

This article walks through implementing SSL pinning in Flutter to prevent man-in-the-middle attacks. The author shares lessons learned from KBTG's banking industry experience, where they follow OWASP security standards and practice strict data privacy (developers can't even access their own database).

Key Takeaways

Critical Insight

Basic SSL pinning in Flutter requires dual verification (certificate callback plus SHA256 checking) to truly block man-in-the-middle attacks, but newer libraries can simplify the implementation.

The article includes the exact terminal command to extract certificates and explains why pinning exactly four certificates creates the optimal security-flexibility balance.

About This Article

Problem

Amorn Apichattanakul's team found that badCertificateCallback pins intermediate certificates but skips Common Name verification. This gap lets attackers create fake certificates from the same provider and completely bypass the protection.

Solution

KBTG added a second verification layer by pairing badCertificateCallback with SHA256 thumbprint checking. They used the X509Utils library to validate certificates against an allowlist of trusted ones.

Impact

The improved SSL pinning passed KBTG's mobile security penetration tests. Their banking applications can now deploy it safely without accepting fraudulent certificates.