Android Insecure Certificate Validation

Detects Android TrustManager implementations that accept all certificates, disabling SSL/TLS security.

zakirkun c391386 2 files · 3.4 KB Updated

File contents

Android Insecure Certificate Validation

Overview

Android applications that implement custom X509TrustManager with empty or no-op validation methods accept any certificate, including self-signed and attacker-controlled certificates. This completely negates TLS security and enables trivial man-in-the-middle attacks.

Common vulnerable pattern: checkServerTrusted() method with empty body.

Detection Strategy

  • X509TrustManager with empty checkServerTrusted()
  • HostnameVerifier that always returns true
  • setSSLSocketFactory with custom factory that accepts all certs

Remediation

  • Use the default system TrustManager (trusts only CA-signed certs)
  • Implement certificate pinning for sensitive applications using OkHttp CertificatePinner or Android Network Security Config
  • Use the networkSecurityConfig XML for declarative pinning

zakirkun/ice-tea/tree/main/skills/android/certificate-pinning commit c391386b4e

Frequently asked questions

npx skillmds@latest add zakirkun/android-insecure-certificate-validation