91–100 of 113 posts
Earlier quoted context omitted.
You're not forced to use system facilities for TLS on Android. Back when you needed up to date TLS support for your app on older Android versions you would use e.g. BouncyCastle instead of the system's TLS facilities. Probably the same for iOS.
So just figure out which library they’re using and patch that.
Earlier quoted context omitted.
Can't say much about the security, but I suspect it's working by pretending to be a VPN provider and then proxying the traffic. It's then able to install a CA root to generate any certs it needs to MITM traffic. Cert pinning will prevent this from working, but that's the only thing that will.
How do you intercept traffic from apps that use cert pinning? Is the only way to patch the app binary and reinstall the patched binary using a dev certificate? How exactly does one go about patching the binary – is there a tutorial somewhere?
Genuine question here: How is it not absolutely terrifying that an iOS App Store app can man in the middle HTTPS communications made by other apps? Is there some way in which this isn’t poking a hole in exactly the sort of security sandbox that iOS tends to be good at? (And yes there probably is some part of what’s going on that I don’t understand, that’s why I’m asking the question)
The fact that Android has recently made it impossible to MITM apps is really making me consider switching. I don't think I will, because in many other ways Android is still more open, but the analysis is no longer as lopsidedly in Android's favour.
Earlier quoted context omitted.
Whitelisted domains? What? Never heard of that in iOS.
Apple introduced App Transport Security[1] with iOS 9. The setting is configured in your app's Info.plist[2]. [1] https://developer.apple.com/library/content/releasenotes/Gen... [2] https://stackoverflow.com/a/48089038/2044952
[0] Of course you can use the blanket NSAllowsArbitraryLoads to allow plain HTTP everywhere.
Earlier quoted context omitted.
How do you intercept traffic from apps that use cert pinning? Is the only way to patch the app binary and reinstall the patched binary using a dev certificate? How exactly does one go about patching the binary – is there a tutorial somewhere?
Won't an app worth its salt use certificate pinning to prevent this mitm ? In other words - Can I use Charles to sniff FB or watsapp traffic ? I do not use both services, but interested in analyzing their traffic.
How widespread is certificate pinning nowadays in iOS apps? Does anybody have any experiences?
I'm working at a European bank in their iOS team. We use cert pinning for all of our apps, but I have never heard or seen teams using it outside of this project. I guess it's mostly used if the application is doing something critical like money transactions etc.
Earlier quoted context omitted.
Except on iOS you get: - Prompt to allow app to act like VPN - Having to enter your passcode after said prompt It's impossible for apps to MITM silently.
And for the record, the prompt is explicit about the risk: "All network activity on this iPhone may be filtered or monitored when using VPN."
I use the desktop product daily so I picked this up. I frequently proxy my phone through my desktop but I figured this would be fun to play with if nothing else. I turned it on for literally one second and the first thing it captured was traffic from an app I used briefly several years ago and not since. Cool!
That sounds like a great tool for enhancing battery life, if you delete all the „overzealous“ apps. Charles could show a list of recommended apps to delete.
But something like "Little Snitch for iOS" would fit the bill.
Genuine question here: How is it not absolutely terrifying that an iOS App Store app can man in the middle HTTPS communications made by other apps? Is there some way in which this isn’t poking a hole in exactly the sort of security sandbox that iOS tends to be good at? (And yes there probably is some part of what’s going on that I don’t understand, that’s why I’m asking the question)
Except on iOS you get: - Prompt to allow app to act like VPN - Having to enter your passcode after said prompt It's impossible for apps to MITM silently.
Wish I could get a more consistent way of intercepting websocket traffic from iOS (specifically, wss traffic).