Charles Proxy now available on iOS • Hacker News Board

Re: Charles Proxy now available on iOS

#51

Post by comex » Wed, Mar 28, 2018, 5:28 AM UTC

jawngee wrote: post #49

yodon wrote: post #34

Genuine question here: How is it not absolutely terrifying that an iOS App Store app can man in the middle HTTPS communications made by other apps? Is there some way in which this isn’t poking a hole in exactly the sort of security sandbox that iOS tends to be good at? (And yes there probably is some part of what’s going on that I don’t understand, that’s why I’m asking the question)

Except on iOS you get: - Prompt to allow app to act like VPN - Having to enter your passcode after said prompt It's impossible for apps to MITM silently.

And for the record, the prompt is explicit about the risk: "All network activity on this iPhone may be filtered or monitored when using VPN."

Re: Charles Proxy now available on iOS

#52

Post by webo » Wed, Mar 28, 2018, 5:28 AM UTC

joshenders wrote: post #45

thisacctforreal wrote: post #5

Earlier quoted context omitted.

It seems to include SSL support as well https://jasdev.me/intercepting-ios-traffic

mitmproxy supports TLS just fine. It had a simple setup for installing a root CA in your device.

iirc, you have to do additional setup for Android 7+ apps -- installing a custom apk with modified manifest.xml for each app that you want to intercept TLS traffic.

Re: Charles Proxy now available on iOS

#53

Post by cbrevik » Wed, Mar 28, 2018, 5:32 AM UTC

yodon wrote: post #38

simcop2387 wrote: post #35

Earlier quoted context omitted.

Can't say much about the security, but I suspect it's working by pretending to be a VPN provider and then proxying the traffic. It's then able to install a CA root to generate any certs it needs to MITM traffic. Cert pinning will prevent this from working, but that's the only thing that will.

Supposed sandboxing against malicious apps is precisely why I run iOS rather than Android. I get that Charles isn’t malicious, but what’s keeping any random free game app from doing the same thing? (Again, intended as a real question not a rhetorical one)

I’d guess App Store reviews stops that.

Re: Charles Proxy now available on iOS

#54

Post by cbrevik » Wed, Mar 28, 2018, 5:37 AM UTC

I like this a lot, but most of the time I use Charles for more than recording traffic. For example, checking how my apps behaves if I throttle certain endpoints, or rewrite responses. Hoping those features makes it into a future version!

Re: Charles Proxy now available on iOS

#55

Post by gdavisson » Wed, Mar 28, 2018, 5:45 AM UTC

yodon wrote: post #38

simcop2387 wrote: post #35

Earlier quoted context omitted.

Can't say much about the security, but I suspect it's working by pretending to be a VPN provider and then proxying the traffic. It's then able to install a CA root to generate any certs it needs to MITM traffic. Cert pinning will prevent this from working, but that's the only thing that will.

Supposed sandboxing against malicious apps is precisely why I run iOS rather than Android. I get that Charles isn’t malicious, but what’s keeping any random free game app from doing the same thing? (Again, intended as a real question not a rhetorical one)

Setting up Charles requires two explicit authorization steps (each requiring passcode/fingerprint/face verification): First, network interception requires adding a VPN config (the dialog warns that "All network activity on this iPhone may be filtered or monitored when using VPN"). Second, SSL MITM requires installing and trusting a root CA certificate (the relevant prompts in iOS are less clear -- they say that the cert will not be trusted until you enable it, but don't explain the implications if you do enable it).

Re: Charles Proxy now available on iOS

#56

Post by sjtgraham » Wed, Mar 28, 2018, 5:56 AM UTC

ce4 wrote: post #44

saagarjha wrote: post #26

Earlier quoted context omitted.

I've never done this personally, but I'm pretty sure there is no way to protect against hooking and/or patching functions in Secure Transport (iOS's low-level TLS stack), since all network traffic goes through these APIs. I'm sure there's something similar in Android.

You're not forced to use system facilities for TLS on Android. Back when you needed up to date TLS support for your app on older Android versions you would use e.g. BouncyCastle instead of the system's TLS facilities. Probably the same for iOS.

You can still patch statically linked libraries. Either statically in an editor and resign or dynamically by changing page protection to rwx, and writing a jump to the alternative implementation. Latter requires entitlements, or jailbreak on iOS.

Re: Charles Proxy now available on iOS

#57

Post by tomduncalf » Wed, Mar 28, 2018, 6:05 AM UTC

Awesome news. Charles has been such a helpful debugging tool over the years. Less so for web stuff in these days of browser dev tools being so advanced, but the ability to inspect traffic system wide is still really useful outside webdev, and sometimes it can be useful to verify something dev tools tell you.

All developers should get this for iOS, it’s bound to be useful and if not it will at least be interesting to see what you’d phone is getting up to online!

Re: Charles Proxy now available on iOS

#58

Post by feelin_googley » Wed, Mar 28, 2018, 6:11 AM UTC

ktta wrote: post #46

feelin_googley wrote: post #12

Imagine if the user could compile their own kernels for iOS^W^W [edit] that can control an iPhone. She enables IP forwarding in the kernel configuration. Maybe she can also disable some crucial bits for interacting with the baseband. She only wants wifi to work. Then she uses this phone with the custom kernel (phone #1) as a gateway for another phone (phone #2). She can easily block ads and other undesired traffic de…

Looks like she wants Android, specifically, something like LineageOS, or even CopperheadOS for better security.

For example, use an Android phone as "phone #1", the gateway for an iPhone, "phone #2".

Also I used the term "destined" but just to be clear I meant both ingress and egress traffic.

Re: Charles Proxy now available on iOS

#59

Post by rimliu » Wed, Mar 28, 2018, 6:39 AM UTC

cbrevik wrote: post #54

I like this a lot, but most of the time I use Charles for more than recording traffic. For example, checking how my apps behaves if I throttle certain endpoints, or rewrite responses. Hoping those features makes it into a future version!

Maybe it is worth mentioning that iOS has the ability to throttle the network itself—it's under "Settings"->"Developer"->"Network Link Conditioner". There is also a pref pane in Addition tools download for Xcode which allows to do the same on the Mac.

Re: Charles Proxy now available on iOS

#60

Post by cstrat » Wed, Mar 28, 2018, 6:42 AM UTC

I'm trying to get it to work but whenever I have the VPN enabled all network traffic fails (HTTP and HTTPS).

Anyone else have this issue? The website isn't giving me much insight :(

edit: I'm on the latest iOS beta. Could that be why? funny that I'm troubleshooting an app which is largely meant for troubleshooting apps...