21–30 of 113 posts
Sucks that more and more 3rd party apps are adding pinning to their code so you can't sniff their traffic. This is a great tool for first party debugging though :) Nice work Charles!
Of course, pinning is trivially defeated if you have debug-level access to the app because you could just intercept any network call.
Earlier quoted context omitted.
Of course, pinning is trivially defeated if you have debug-level access to the app because you could just intercept any network call.
Could you go about describing how this would work for a 3rd party app like Uber for example?
It seems like you need a jailbroken device, and that there are tools such as SSL Kill Switch[1]
[0] https://news.ycombinator.com/item?id=15757878 [1] https://github.com/iSECPartners/ios-ssl-kill-switch
Note that both AdBlock and Charlex rely on iOS's VPN feature, and only one can be enabled at a time.
[0] https://itunes.apple.com/us/app/adblock/id691121579?mt=8http...
Imagine if the user could compile their own kernels for iOS^W^W [edit] that can control an iPhone. She enables IP forwarding in the kernel configuration. Maybe she can also disable some crucial bits for interacting with the baseband. She only wants wifi to work. Then she uses this phone with the custom kernel (phone #1) as a gateway for another phone (phone #2). She can easily block ads and other undesired traffic de…
You're free to compile XNU yourself; it's just the part where you load it onto your iPhone that doesn't work.
Earlier quoted context omitted.
Of course, pinning is trivially defeated if you have debug-level access to the app because you could just intercept any network call.
Could you go about describing how this would work for a 3rd party app like Uber for example?
Earlier quoted context omitted.
Can you describe what this means?
Hardcoding the exact certificate they expect, to prevent MITM attacks. Of course, not every MITM is malicious, as this item shows.
Hilarity ensues.
Earlier quoted context omitted.
Could you go about describing how this would work for a 3rd party app like Uber for example?
I've never done this personally, but I'm pretty sure there is no way to protect against hooking and/or patching functions in Secure Transport (iOS's low-level TLS stack), since all network traffic goes through these APIs. I'm sure there's something similar in Android.
Earlier quoted context omitted.
Hardcoding the exact certificate they expect, to prevent MITM attacks. Of course, not every MITM is malicious, as this item shows.
Then Geotrust, in a petulant hissyfit, email ~20,000 of their customers private keys to DigiTrust - and the carefully laid plans of updating the app with newer ssl certs pinned 12 and 6 months in advance of expiry are - ummmm - revealed to be flawed... Hilarity ensues.