Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Reverse Engineer Amazon's Whispersync

ptbrowne.github.io

Post reply on HN
Print view View original

21–30 of 38 posts

Re: Reverse Engineer Amazon's Whispersync

#21

Post by rektide »

Godel_unicode wrote: post #14
ptbrowne wrote: post #12

Earlier quoted context omitted.

You're right, this technique would not work if Amazon had used cert pinning. I haven't yet tried to bypass a cert pinning app, but it seems that frameworks like Frida could help : https://medium.com/@ved_wayal/hail-frida-the-universal-ssl-p... .

Or just open up the apk in e.g. apk studio and replace the bundled cert with the one from your mitm proxy. Effectively, that'll repin the app to your proxy specifically. There are more exotic pinning methods that this won't solve (the forever cat-and-mouse game) but it's good for many apps.

It's a problem that, alas, must be tackled somewhat uniquely on every platform, where-as previously users were free to manage their own Certificate Authorities as they wished. Now users are safe & secure from themselves. :/ Admittedly there were a lot of problems with poorly managed CA stores, users being abused, but cert-pinning feels like such a drastic overreach in preventing any form of user control.

Techniques like this "rebuild your apk" are interesting & good to have, but every OS needs it's own bag of tricks. It's probably not a total show-stopper, but news like today's that Windows 10 will only install signed driver software (an admittedly niche-ish case), the closed Apple store,... there's a lot of places side-loading is not an option. Do those apps get a pass, get to be complete black-box software that we the users have zero ability to look at or understand?

[1] https://www.zdnet.com/article/windows-10-will-start-blocking...

Re: Reverse Engineer Amazon's Whispersync

#22

Post by rektide »

yellow_lead wrote: post #20
ptbrowne wrote: post #12

Earlier quoted context omitted.

You're right, this technique would not work if Amazon had used cert pinning. I haven't yet tried to bypass a cert pinning app, but it seems that frameworks like Frida could help : https://medium.com/@ved_wayal/hail-frida-the-universal-ssl-p... .

This module works well too. https://github.com/Fuzion24/JustTrustMe

Amazing tool, neat trick. It requires xposed framework though, which is an interception framework for Android that requires root access to install.

Less and less devices seem to have root, and almost no devices these days seem to allow unlocking the bootloader, which is even better.

It feels like users are getting kicked further & further & further out. We are less & less able to have any chance to understand what computing is, & this deeply deeply hurts us, I tend to believe.

Re: Reverse Engineer Amazon's Whispersync

#23

Post by Godel_unicode »

rektide wrote: post #21
Godel_unicode wrote: post #14

Earlier quoted context omitted.

Or just open up the apk in e.g. apk studio and replace the bundled cert with the one from your mitm proxy. Effectively, that'll repin the app to your proxy specifically. There are more exotic pinning methods that this won't solve (the forever cat-and-mouse game) but it's good for many apps.

It's a problem that, alas, must be tackled somewhat uniquely on every platform, where-as previously users were free to manage their own Certificate Authorities as they wished. Now users are safe & secure from themselves. :/ Admittedly there were a lot of problems with poorly managed CA stores, users being abused, but cert-pinning feels like such a drastic overreach in preventing any form of user control. Techniques l…

You're making this sound so much harder than it is, though. None of the techniques for bypassing the security enhancements is difficult, nor are they undocumented. Who are these hobbyists who want to reverse engineer the whispersync protocol but can't follow a simple tutorial to swap out a CA?

Re: Reverse Engineer Amazon's Whispersync

#24

Post by p_l »

fprog wrote: post #4

Loved section 1.5.1, "Bytes in color". The author wrote code to help them understand a custom binary format by coloring the bytes based on their value, making patterns in the format visually obvious. The structure of the binary becomes much more clear when visualized this way. That's a handy approach I've mentally bookmarked for the future.

I was in a team that, among other things, was working on integrating 3d visualisation of binary files in a hex editor with the plan of making a reverse engineering tool (mainly for security).

It's a very powerful method.

Re: Reverse Engineer Amazon's Whispersync

#25

Post by rektide »

Godel_unicode wrote: post #23
rektide wrote: post #21

Earlier quoted context omitted.

It's a problem that, alas, must be tackled somewhat uniquely on every platform, where-as previously users were free to manage their own Certificate Authorities as they wished. Now users are safe & secure from themselves. :/ Admittedly there were a lot of problems with poorly managed CA stores, users being abused, but cert-pinning feels like such a drastic overreach in preventing any form of user control. Techniques l…

You're making this sound so much harder than it is, though. None of the techniques for bypassing the security enhancements is difficult, nor are they undocumented. Who are these hobbyists who want to reverse engineer the whispersync protocol but can't follow a simple tutorial to swap out a CA?

you've listed one platform (of many) where it's possible to (in some cases where there is a .cert or .pem file sitting in an apk), updated that apk pkg, & then use side-loading (not available on os'es) to install that hacked package.

there's a number of caveats to your steps, it will definitely not be this easy in all cases. and i while this wasn't all that difficult, it's still a situation where the OS is actively working to prevent the user from being able to understand their system. and most platforms don't provide even this much of an affordance, of opening, rebuilding, & side-loading packages.

Re: Reverse Engineer Amazon's Whispersync

#26

Post by LargoLasskhyfv »

p_l wrote: post #24
fprog wrote: post #4

Loved section 1.5.1, "Bytes in color". The author wrote code to help them understand a custom binary format by coloring the bytes based on their value, making patterns in the format visually obvious. The structure of the binary becomes much more clear when visualized this way. That's a handy approach I've mentally bookmarked for the future.

I was in a team that, among other things, was working on integrating 3d visualisation of binary files in a hex editor with the plan of making a reverse engineering tool (mainly for security). It's a very powerful method.

Like CantorDust by Christopher Domas@Batelle?

https://www.youtube.com/watch?v=4bM3Gut1hIk really blew my mind when I saw it.

Btw. about 8 years later they finally delivered, by releasing it as plug-in for Ghidra! Yay!

https://github.com/Battelle/cantordust

Re: Reverse Engineer Amazon's Whispersync

#27

Post by rckoepke »

fprog wrote: post #4

Loved section 1.5.1, "Bytes in color". The author wrote code to help them understand a custom binary format by coloring the bytes based on their value, making patterns in the format visually obvious. The structure of the binary becomes much more clear when visualized this way. That's a handy approach I've mentally bookmarked for the future.

This is my favorite version of it:

https://www.youtube.com/watch?v=4bM3Gut1hIk&list=PLUyyOw61zx...

Some people have taken this concept very far. Batelle's CantorDust (was?) a pretty fully developed 3D visualization software for binary packages utilizing many different views and filters with convenient UX for selecting blocks of code graphically and zooming in on the corresponding hex, or vice-versa.

Edit: I looked very hard for this software about 6-12 months ago and couldn't find anything...it appeared to be vaporware. However, 'LargoLasskhyfv posted in this thread tree at the exact same time I did and noted that it was just released about 3 months ago as a plugin for Ghidra. I'm very excited to play around with it.

Re: Reverse Engineer Amazon's Whispersync

#28

Post by rckoepke »

LargoLasskhyfv wrote: post #26
p_l wrote: post #24

Earlier quoted context omitted.

I was in a team that, among other things, was working on integrating 3d visualisation of binary files in a hex editor with the plan of making a reverse engineering tool (mainly for security). It's a very powerful method.

Like CantorDust by Christopher Domas@Batelle? https://www.youtube.com/watch?v=4bM3Gut1hIk really blew my mind when I saw it. Btw. about 8 years later they finally delivered, by releasing it as plug-in for Ghidra! Yay! https://github.com/Battelle/cantordust

Does that have the 3D visualizations shown in Christopher's 2013-2014 talks? Both the github readme and the associated blogpost from July make it look like it only includes 2D visualizations. There are fewer "view" buttons on the right toolbar than the demo had. I should answer my own question by simply trying it out, but I'm not quite sure when I'll have a moment to get around to it.

[0]: https://inside.battelle.org/blog-details/battelle-publishes-...

Re: Reverse Engineer Amazon's Whispersync

#29

Post by LargoLasskhyfv »

rckoepke wrote: post #28
LargoLasskhyfv wrote: post #26

Earlier quoted context omitted.

Like CantorDust by Christopher Domas@Batelle? https://www.youtube.com/watch?v=4bM3Gut1hIk really blew my mind when I saw it. Btw. about 8 years later they finally delivered, by releasing it as plug-in for Ghidra! Yay! https://github.com/Battelle/cantordust

Does that have the 3D visualizations shown in Christopher's 2013-2014 talks? Both the github readme and the associated blogpost from July make it look like it only includes 2D visualizations. There are fewer "view" buttons on the right toolbar than the demo had. I should answer my own question by simply trying it out, but I'm not quite sure when I'll have a moment to get around to it. [0]: https://inside.battelle.org…

I don't know. Just discovered it because I searched for the link to the video I had in mind.

edit: Hrrmpf. "Zu früh gefreut/rejoiced too early". Scanning the git repository it doesn't look like it would.

But can't/won't install/test it atm. Maybe over the weekend :(

Re: Reverse Engineer Amazon's Whispersync

#30

Post by p_l »

LargoLasskhyfv wrote: post #26
p_l wrote: post #24

Earlier quoted context omitted.

I was in a team that, among other things, was working on integrating 3d visualisation of binary files in a hex editor with the plan of making a reverse engineering tool (mainly for security). It's a very powerful method.

Like CantorDust by Christopher Domas@Batelle? https://www.youtube.com/watch?v=4bM3Gut1hIk really blew my mind when I saw it. Btw. about 8 years later they finally delivered, by releasing it as plug-in for Ghidra! Yay! https://github.com/Battelle/cantordust

I believe CantorDust was the direct inspiration for our code (I wasn't exactly involved in the editor project though, so hard to call it "our").

The moment you mentioned "CantorDust" it was like a giant lightbulb filled with memories of discussions :)

Post reply on HN