Security of SSL Pinning

Question

I have an iOS app which implements SSL Pinning. I compare the remote certificate against the locally stored certificate and proceed depending on the result of the comparison. If both certificates are equal, the URL connection is permitted. Otherwise, it is denied. My question is this: Can an attacker change the local certificate stored in the app (.ipa) with another certificate? This would allow the attacker to see all of my requests and responses.

Thanks.

Answer 1

是的，但仅在越狱设备上，因为在非越狱设备上，您无法查看已安装应用程序的内容。