Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Yes, Android 14 still allows modification of system certificates

g1a55er.net

Post reply on HN
Print view View original

11–20 of 89 posts

Re: Yes, Android 14 still allows modification of system certificates

#11

Post by kelnos »

maven29 wrote: post #4

There are ways to bypass any of these restrictions imposed by the Android system, even if they were real. Android ships with eBPF, so you just need root. https://github.com/gojue/ecapture

"Just" is doing a lot of work there. Getting root isn't always possible or easy, depending on your device manufacturer. And if you do manage to get root, your phone will likely stop passing SafetyNet, and you'll lose access to a bunch of apps that you may care about. SafetyNet can be spoofed in some situations, but not all, and even when spoofing does work, it all seems very brittle to me.

Yes, of course, you can do this, but let's not pretend there aren't trade offs.

Re: Yes, Android 14 still allows modification of system certificates

#12

Post by orangepurple »

post_break wrote: post #8
maven29 wrote: post #4

There are ways to bypass any of these restrictions imposed by the Android system, even if they were real. Android ships with eBPF, so you just need root. https://github.com/gojue/ecapture

How many normal phones can you root these days?

Anything that LineageOS supports https://wiki.lineageos.org/devices/

Re: Yes, Android 14 still allows modification of system certificates

#13

Post by downWidOutaFite »

modeless wrote: post #10
post_break wrote: post #8

Earlier quoted context omitted.

How many normal phones can you root these days?

Every Pixel phone purchased from the Google store

After wiping all data and losing access to a bunch of features and apps.

Re: Yes, Android 14 still allows modification of system certificates

#14

Post by shadowgovt »

inetknght wrote: post #2

Allowing a user to add system certificates a good thing. The user owns the device.

Everything in the category "the user owns the device" is tricky.

For a lot of users, "It's really hard to break" is a value-add. Every capacity the user has to modify permissions is an opportunity for an attacker to compromise a device. You can see an example of this in web browsers these days, where sites have to `log` a big scary "Don't paste anything someone tells you to paste into here" message into the built-in developer tools because no matter how many safety features get added to the browser security model, the dev tools can bypass them.

It is definitely important that the purchaser knows what kind of phone they're getting (whether it's easy or hard to crack open all the layers of its protection model), but "The phone's protection model is easily broken by the owner" as a universal absolute applied to all devices should be considered harmful.

Re: Yes, Android 14 still allows modification of system certificates

#15

Post by rwmj »

jiofj wrote: post #6
twleo wrote: post #5

Looks good. I hate how IOS does, especially with certificate pinning, so I cannot use my ad-block http mitmproxy to block ads in Apps. EDIT: thanks for people clarifying that pinning is done by Apps and not by IOS.

cert pinning is done by the apps, not by the OS

That's a distinction without a difference in these tightly controlled ecosystems.

Re: Yes, Android 14 still allows modification of system certificates

#16

Post by RockRobotRock »

maven29 wrote: post #4

There are ways to bypass any of these restrictions imposed by the Android system, even if they were real. Android ships with eBPF, so you just need root. https://github.com/gojue/ecapture

Very cool. Does this work better than a Frida hook for capturing encrypted HTTP calls while bypassing cert pinning?

Re: Yes, Android 14 still allows modification of system certificates

#18

Post by __MatrixMan__ »

hospitalJail wrote: post #3

Gosh I love linux/root. I havent needed it on recent androids due to WFH and spending more time on my laptop, but back when I was flying more for work, I was much more into my phone. Cant remember if it was my motorolla or nexus, but I felt like I had a full fledged laptop in my pocket back then. Meanwhile, one of the straws that broke the camels back for Windows was the insane difficulty/impossibility of remove bloa…

I recently got tired of trying to hack together a sane workflow on the windows computers in the lab at my university, so installed nix-on-droid and gotty on my phone.

Now I just open a tab to my phone's IP address and benefit from the big screen and full sized keyboard while still having exactly the tools I'm used to having elsewhere. When I get home and want to resume work on beefier hardware, I just push from my phone, pull from my desktop, and I'm just where I left off, except now with more resources.

You have to be a bit austere about your tool choices to make the similarity happen (sorry VSCode), but it feels like a bit of a superpower just the same.

Re: Yes, Android 14 still allows modification of system certificates

#19

Post by jeroenhd »

kelnos wrote: post #11
maven29 wrote: post #4

There are ways to bypass any of these restrictions imposed by the Android system, even if they were real. Android ships with eBPF, so you just need root. https://github.com/gojue/ecapture

"Just" is doing a lot of work there. Getting root isn't always possible or easy, depending on your device manufacturer. And if you do manage to get root, your phone will likely stop passing SafetyNet, and you'll lose access to a bunch of apps that you may care about. SafetyNet can be spoofed in some situations, but not all, and even when spoofing does work, it all seems very brittle to me. Yes, of course, you can do…

In the context of "changes to Android 14", "just" is right. Android has required root access for modifying random apps since before Android 6, and that's only because many apps didn't bother implementing certificate pinning (which was already known advice at that point).

Alternatively, you can use ADB + Frida to pull an APK from the device, inject a binary, and inject code at runtime using Javascript or Python. That's much easier for intercepting traffic than messing with certificate stores or eBPF ever was in my opinion.

Re: Yes, Android 14 still allows modification of system certificates

#20

Post by ladberg »

rwmj wrote: post #15
jiofj wrote: post #6

Earlier quoted context omitted.

cert pinning is done by the apps, not by the OS

That's a distinction without a difference in these tightly controlled ecosystems.

Android apps could also do certificate pinning with the same effect though? In this case there isn't any difference between Android and iOS in functionality.
Post reply on HN