Systems and methods for detecting certificate pinning

1. A computer-implemented method for detecting certificate pinning, at least a portion of the method being performed by a computing device comprising at least one processor, the method comprising:

attempting, by a security network proxy, to break a network connection between a client device and a server device;

detecting, by the security network proxy, whether the network connection between the client device and the server device is certificate pinned based on a result of attempting to break the network connection; and

performing a security action by the security network proxy to protect the client device at least in part based on detecting whether the network connection between the client device and the server device is certificate pinned;

wherein:

the method further comprises the security network proxy maintaining a domain name system cache by tracking domain name system requests issued by the client device; and

detecting whether a subsequent network connection is pinned comprises the security network proxy looking up an Internet Protocol address for the server device within the domain name system cache to discover a host name with which the security network proxy detected a corresponding application previously engaging.

2. The computer-implemented method of claim 1 , wherein attempting to break the network connection between the client device and the server device comprises intercepting a digital certificate that the server device directed to the client device to establish encrypted communications.

3. The computer-implemented method of claim 2 , wherein attempting to break the network connection between the client device and the server device comprises the security network proxy forwarding a different digital certificate to the client device as a substitute rather than forwarding the digital certificate that the server device directed to the client device.

4. The computer-implemented method of claim 3 , wherein the attempt to break the network connection between the client device and the server device succeeds in response to an application at the client device verifying that the different digital certificate does not match an identifier for a digital certificate expected by the application according to certificate pinning.

5. The computer-implemented method of claim 2 , wherein the digital certificate that the server device directed to the client device to establish encrypted communications is provided by the server device according to the Transport Layer Security protocol.

6. The computer-implemented method of claim 5 , wherein the Transport Layer Security protocol comprises

Transport Layer Security protocol version 1.3 or greater.

7. The computer-implemented method of claim 1 , wherein the security action performed by the security network proxy comprises whitelisting a domain corresponding to the server device based on detecting that the network connection between the client device and the server device is certificate pinned.

8. The computer-implemented method of claim 1 , wherein the security network proxy maintains the domain name system cache that maps domains to Internet Protocol addresses.

9. The computer-implemented method of claim 1 , wherein detecting whether the network connection between the client device and the server device is certificate pinned is based on an analysis of at least one of:

a Transport Layer Security protocol handshake message;

a transmission control protocol FIN packet; or

a transmission control protocol RST packet.

10. The computer-implemented method of claim 1 , wherein performing the security action by the security network proxy comprises:

decrypting network traffic;

extracting at least one attribute of the decrypted network traffic; and

applying a security policy to subsequent encrypted network traffic based on the extracted attribute.

11. A system for detecting certificate pinning, the system comprising:

an attempting module, stored in memory, that attempts, as a part of a security network proxy, to break a network connection between a client device and a server device;

a detection module, stored in memory, that detects, as a part of the security network proxy, whether the network connection between the client device and the server device is certificate pinned based on a result of attempting to break the network connection;

a performance module, stored in memory, that performs a security action as a part of the security network proxy to protect the client device at least in part based on detecting whether the network connection between the client device and the server device is certificate pinned; and

at least one physical processor configured to execute the attempting module, the detection module, and the performance module;

wherein:

the security network proxy maintains a domain name system cache by tracking domain name system requests issued by the client device; and

the detection module is configured to detect whether a subsequent network connection is pinned at least in part through the security network proxy looking up an Internet Protocol address for the server device within the domain name system cache to discover a host name with which the security network proxy detected a corresponding application previously engaging.

12. The system of claim 11 , wherein the attempting module attempts to break the network connection between the client device and the server device by intercepting a digital certificate that the server device directed to the client device to establish encrypted communications.

13. The system of claim 12 , wherein the attempting module attempts to break the network connection between the client device and the server device at least in part by the security network proxy forwarding a different digital certificate to the client device as a substitute rather than forwarding the digital certificate that the server device directed to the client device.

14. The system of claim 13 , wherein the attempt to break the network connection between the client device and the server device succeeds in response to an application at the client device verifying that the different digital certificate does not match an identifier for a digital certificate expected by the application according to certificate pinning.

15. The system of claim 12 , wherein the digital certificate that the server device directed to the client device to establish encrypted communications is provided by the server device according to the Transport Layer Security protocol.

16. The system of claim 15 , wherein the Transport Layer Security protocol comprises

Transport Layer Security protocol version 1.3 or greater.

17. The system of claim 11 , wherein the security action performed by the security network proxy comprises whitelisting a domain corresponding to the server device based on detecting that the network connection between the client device and the server device is certificate pinned.

18. The system of claim 11 , wherein the security network proxy maintains the domain name system cache that maps domains to Internet Protocol addresses.

19. The system of claim 11 , wherein the detection module detects whether the network connection between the client device and the server device is certificate pinned based on an analysis of at least one of:

a Transport Layer Security protocol handshake message;

a transmission control protocol FIN packet; or

a transmission control protocol RST packet.

20. A non-transitory computer-readable medium comprising one or more computer-readable instructions that, when executed by at least one processor of a computing device, cause the computing device to:

attempt, by a security network proxy, to break a network connection between a client device and a server device;

detect, by the security network proxy, whether the network connection between the client device and the server device is certificate pinned based on a result of attempting to break the network connection; and

perform a security action by the security network proxy to protect the client device at least in part based on detecting whether the network connection between the client device and the server device is certificate pinned;

wherein:

the security network proxy maintains a domain name system cache by tracking domain name system requests issued by the client device; and

detecting whether a subsequent network connection is pinned comprises the security network proxy looking up an Internet Protocol address for the server device within the domain name system cache to discover a host name with which the security network proxy detected a corresponding application previously engaging.