IoT Penetration Testing Cookbook

Android

In the preceding example, an Android app creates a KeyStore with CAs (trusted certificates) that initializes the TrustManager whose job is to validate only the certificates that are within the KeyStore:

1. Create the KeyPinStore class that is thread-safe (public static synchronized):

public class KeyPinStore { 
 
    private static KeyPinStore instance = null; 
    private SSLContext sslContext = SSLContext.getInstance("TLS"); 
 
    public static synchronized KeyPinStore getInstance() throws CertificateException, IOException, KeyStoreException, NoSuchAlgorithmException, KeyManagementException{ 
        if (instance == null){ 
            instance = new KeyPinStore(); 
        } 
        return instance; 
    } 

2. Load the CAs that are inside the application's assets directory:

private KeyPinStore() ...