Android Insecure Certificate Validation
Overview
Android applications that implement custom X509TrustManager with empty or no-op validation methods accept any certificate, including self-signed and attacker-controlled certificates. This completely negates TLS security and enables trivial man-in-the-middle attacks.
Common vulnerable pattern: checkServerTrusted() method with empty body.
Detection Strategy
X509TrustManagerwith emptycheckServerTrusted()HostnameVerifierthat always returns truesetSSLSocketFactorywith custom factory that accepts all certs
Remediation
- Use the default system TrustManager (trusts only CA-signed certs)
- Implement certificate pinning for sensitive applications using OkHttp
CertificatePinneror Android Network Security Config - Use the
networkSecurityConfigXML for declarative pinning