Otukan keeps your app talking only to your servers, even on a device or network set up to listen in. It pins your server keys, blocks cleartext and weak connections, detects proxies, rogue certificate authorities and redirection, and catches attempts to hook the app’s own certificate validation. When it sees interception, the app responds per endpoint and your backend receives the signal. Evaluate it by attacking the connection in a lab and checking both results. Otukan covers Android, iOS, Flutter and React Native apps, with each control scoped per platform. Server-side TLS configuration stays with your infrastructure team.
The path between app and server
Every sensitive feature in your app ends in a network call: a login, a balance, a payment, a document. The trust boundary is the TLS connection that carries it. If someone can sit inside that connection, they can read tokens, change amounts or map your API for later abuse.
How the connection is attacked
- Added trust. A certificate authority is installed on the device, by a user, a malicious profile or malware, and an inspection proxy uses it to decrypt traffic.
- Hooked validation. The attacker leaves the network alone and instead hooks the app’s certificate checks so they always pass.
- Redirection. DNS or routing is changed so your hostname leads somewhere else.
- Downgrade. A library or misconfiguration lets data travel over weak or unencrypted connections.
The same techniques serve two audiences. Fraudsters use them against your customers on hostile networks. Analysts use them on their own devices to study your API before automating it. Network protection answers both.
| Attack | Where it happens | Otukan control |
|---|---|---|
| Added trust | Device trust store | Certificate pinning, man-in-the-middle prevention |
| Hooked validation | Inside the app process | Runtime detection of hooks on network code |
| Redirection | DNS and routing | DNS and connection integrity |
| Downgrade | App libraries and settings | TLS session protection, cleartext blocking |
Who secures each end of the connection
Platform configuration
Both platforms provide solid defaults. Android lets apps declare trusted authorities and pins in a network security configuration, and apps built for current Android versions do not trust authorities that users add unless they opt in. iOS enforces encrypted connections through App Transport Security and supports pinned keys in the app’s settings. These configurations are a good start, but they are only as strong as the app process that applies them.
Runtime checks in the app
Otukan adds the part the configuration cannot: watching for tampering while the app runs. It detects proxies and inspection tools, hooks on validation code and redirection, and applies your response for each endpoint. Because hooking is the usual way pinning is bypassed, runtime integrity sits at the centre of network protection. For the runtime layer, see mobile RASP.
Your servers
Your servers own the other end of the connection. They hold private keys, present certificates, enforce TLS settings and decide whether to trust a request. Otukan sends network signals with the next permitted request, so your backend can step up or refuse a session that was seen passing through a proxy. For request-level evidence, see mobile API protection.
How to evaluate network protection
Stacks and platforms
Ask how each control works on Android and on iOS, and for Flutter and React Native apps, which often ship their own networking layers. A pin that protects native code may not cover a framework’s HTTP client unless it is applied there too. Otukan documents each control per platform and per networking stack.
Lab tests to run
Test in a lab on your own devices. Install an inspection proxy and its certificate authority and confirm pinned calls fail. Hook the validation code on a test device and confirm the bypass is detected. Point a hostname elsewhere through DNS and confirm the connection is refused. Search for cleartext requests from bundled libraries. Each test should leave a record your backend can show.
Legitimate interception and rotation
Plan for legitimate interception. Some workplaces and security tools inspect TLS, and your policy should choose where to allow it. Rehearse certificate rotation before production needs it, with backup pins already shipped. Measure connection time on real mobile networks with the protected build. Rotation is covered on the pinning rotation guide, and pinning in depth is on certificate pinning.