Mobile App Privacy Testing with SSL Unpinning and File Tracking
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing methods fail to provide comprehensive information about privacy techniques, file access, and SSL pinning in mobile applications, limiting data security analysis and visibility.
Innovation Solution
A system and method employing dynamic hooking to track file requests, SSL unpinning, and dynamic instrumentation for analyzing and testing mobile application privacy, including encryption and obfuscation scanning, and generating analysis reports.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Loss of information
If direct HTTPS interception methods are used, then network communication visibility is improved, but SSL pinning certificates block the interception
Solution Approach 1:
The patent performs SSL unpinning operations before intercepting HTTPS traffic. The system identifies and removes SSL pinning certificates from the mobile application in advance, allowing subsequent network interception to succeed. This preliminary action resolves the contradiction by eliminating the protective barrier before the interception attempt.
Solution Approach 2:
The patent introduces a proxy server as an intermediary between the mobile application and the internet. This proxy server captures and inspects HTTPS traffic without requiring direct interception at the application level, bypassing SSL pinning restrictions. The intermediary enables visibility while maintaining the application's original security configuration.
2Measurement precision
If comprehensive monitoring of file requests is implemented, then privacy analysis capability is improved, but device performance and battery consumption increase
Solution Approach 1:
The patent implements selective monitoring of file requests based on predefined criteria such as file types, paths, and application contexts. Instead of monitoring all file operations uniformly, the system focuses on specific high-risk categories, achieving effective privacy analysis with reduced processing overhead and lower battery consumption.
Solution Approach 2:
The system allows users to configure monitoring parameters and priorities according to their specific privacy concerns. Users can enable or disable monitoring for different applications, file types, or time periods, allowing the monitoring mechanism to adapt to user needs and minimize unnecessary resource consumption while maintaining essential privacy protection capabilities.
3Loss of information
If dynamic hooking is used to track file requests, then file access visibility is improved, but application stability may be affected
Solution Approach 1:
The patent uses a proxy server as an intermediary to capture file access information without directly hooking into the application's core processes. The proxy intercepts network traffic and file system calls at a higher level, providing visibility into file access patterns while minimizing disruption to the application's execution flow and maintaining stability.
Solution Approach 2:
The patent replaces direct mechanical hooking into application binaries with software-based interception methods using existing Android system interfaces and network proxies. This substitution reduces the invasiveness of the monitoring mechanism, lowering the risk of application crashes or instability while still achieving comprehensive file access visibility through systematic observation of system calls and network traffic.
Data Source
AI summary
A method for testing and analyzing privacy of a mobile application is disclosed. The method includes displaying (203)/(502) a list of mobile devices connected to a privacy testing system; enabling (202) a user to select a target mobile application for carrying out a privacy analysis and testing; checking (204)/(504) if an android debug bridge (ADB) command line tool is enabled on the mobile device; employing (215)/(508) an SSL unpinning process if the mobile application is embedded with SSL pinning; scanning (225)/(510) one or more encryptions and one or more obfuscations used by the target mobile application; monitoring (220)/(514) one or more file access requests generated by the target mobile application and generating (230)/(516) an analysis testing report of the target mobile application.