Mobile Network Security

What Is Broken and Why

Mobile apps fail network security when they allow cleartext HTTP traffic, disable TLS certificate validation, or implement certificate pinning incorrectly. Custom X509TrustManager implementations that accept all certificates (empty checkServerTrusted) are a common developer shortcut that makes the entire TLS layer useless. ATS exceptions in iOS Info.plist or Android Network Security Configuration that allow arbitrary cleartext expose all traffic to MITM. Apps that call onReceivedSslError().proceed() in WebViewClient bypass all certificate errors. Certificate pinning without key backup pins causes production outages, so developers remove pinning — leaving no protection.

Key Signals

• Android: android:networkSecurityConfig pointing to XML with <domain-config cleartextTrafficPermitted="true">
• Android: android:usesCleartextTraffic="true" in manifest
• iOS: NSAllowsArbitraryLoads: true in Info.plist ATS section
• Custom X509TrustManager with empty checkServerTrusted() method body
• HostnameVerifier returning true for all hosts: ALLOW_ALL_HOSTNAME_VERIFIER
• SSLContext.init(null, arrayOf(trustAllManager), null)
• WebViewClient onReceivedSslError calling handler.proceed()
• TLS 1.0/1.1 explicitly enabled via SSLParameters.setProtocols()
• No pin-set in Network Security Configuration for sensitive domains
• iOS NSURLSessionDelegate returning no error for invalid certificates
• URLSession.shared with no custom delegate (no pinning) for high-value endpoints