Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

About the security content of iOS 7.0.6

support.apple.com

Post reply on HN
Print view View original

1–10 of 155 posts

Re: About the security content of iOS 7.0.6

#2

Post by randomstring »

Sounds like a classic Man-in-the-Middle (MITM) attack.

Just a guess, but from the short description I suspect if you have control over DHCP you can get iOS to use your proxy. From there you can use something like mitmproxy ( http://mitmproxy.org/) to forge SSL certificates on the fly and intercept and decrypt SSL traffic without any warnings showing up on the iOS device.

Re: About the security content of iOS 7.0.6

#5

Post by nwh »

randomstring wrote: post #2

Sounds like a classic Man-in-the-Middle (MITM) attack. Just a guess, but from the short description I suspect if you have control over DHCP you can get iOS to use your proxy. From there you can use something like mitmproxy ( http://mitmproxy.org/ ) to forge SSL certificates on the fly and intercept and decrypt SSL traffic without any warnings showing up on the iOS device.

You can do that but you'll be throwing certificate errors everywhere if they're self signed. By the sounds of it this is a bypass or method of getting around the CA altogether.

Re: About the security content of iOS 7.0.6

#7

Post by helper »

Wow, this sounds bad. It sure would be nice if Apple gave us a little bit more information, like when the bug was introduced and what exactly was not being verified. Until we get more information, you should assume the worst that all your IOS TLS traffic might be compromised.
Post reply on HN