Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Tracking my phone's silent connections

kushaldas.in

Post reply on HN
Print view View original

11–20 of 110 posts

Re: Tracking my phone's silent connections

#11

Post by kgwxd »

xg15 wrote: post #6

I'm not sure how the situation is with Apple, but it always bothered me that on Android, apps can implement their own logic for TLS certificate validation. Apps can use this to hardcode key-pinning and make it effectively impossible (short of patching the app) to inspect an encrypted connection, even if you're the owner of the device. I feel the push for DoH will make this even worse - because then you won't even kno…

Once you install closed source software, you're no longer the sole owner of your computer. If an app wants to hide data, and they can't rely on tls to do it, they'll just add another layer of encryption.

Re: Tracking my phone's silent connections

#12

Post by hedvig »

xg15 wrote: post #9
Shaaaaaaare wrote: post #7

Earlier quoted context omitted.

Unfortunately Google both supports and recommends this. Recently they've even made it easy for apps to automatically ignore any custom certificates added to the trust store, so they don't even have to bother to implement pinning.

Yeah, I'm honestly not surprised. Apologies for the cynicism, but sometimes I wonder if the pushes for HTTPS-everywhere, certificate transparency and DoH are really more for the privacy of app developers instead of the privacy of users...

Supply-side economics is and always will be dominant.

Re: Tracking my phone's silent connections

#13

Post by Nextgrid »

mox1 wrote: post #8
xg15 wrote: post #6

I'm not sure how the situation is with Apple, but it always bothered me that on Android, apps can implement their own logic for TLS certificate validation. Apps can use this to hardcode key-pinning and make it effectively impossible (short of patching the app) to inspect an encrypted connection, even if you're the owner of the device. I feel the push for DoH will make this even worse - because then you won't even kno…

Same for Apple, I've had to bypass this multiple times for pen testing engagements. There are ready to use modules to patch it out, no root / jailbreaking required. There is lots of good security reasons to do this. Further, if they didn't people would just roll a Swift / OBj-C SSL library and do it all themselves, which would be worse I think.

Are you talking about iOS? What solutions exist to bypass certificate pinning without jailbreaking?

Re: Tracking my phone's silent connections

#14

Post by xg15 »

xg15 wrote: post #6

I'm not sure how the situation is with Apple, but it always bothered me that on Android, apps can implement their own logic for TLS certificate validation. Apps can use this to hardcode key-pinning and make it effectively impossible (short of patching the app) to inspect an encrypted connection, even if you're the owner of the device. I feel the push for DoH will make this even worse - because then you won't even kno…

(* secure->security, delete->delegate at the reply below, got caught by the noprocrast thing at the worst of times, sorry...)

Re: Tracking my phone's silent connections

#15

Post by saagarjha »

xg15 wrote: post #10
mox1 wrote: post #8

Earlier quoted context omitted.

Same for Apple, I've had to bypass this multiple times for pen testing engagements. There are ready to use modules to patch it out, no root / jailbreaking required. There is lots of good security reasons to do this. Further, if they didn't people would just roll a Swift / OBj-C SSL library and do it all themselves, which would be worse I think.

Sorry for asking, but what secure reasons would that be? If Apple wanted, they could prohibit the last point by requiring all apps to delete TLS handling to the OS and failing the review otherwise.

It stops people who have root certificates installed on their phone (e.g. the Facebook research app from a couple weeks ago) from being able to monitor traffic.

Re: Tracking my phone's silent connections

#17

Post by john61 »

xg15 wrote: post #9
Shaaaaaaare wrote: post #7

Earlier quoted context omitted.

Unfortunately Google both supports and recommends this. Recently they've even made it easy for apps to automatically ignore any custom certificates added to the trust store, so they don't even have to bother to implement pinning.

Yeah, I'm honestly not surprised. Apologies for the cynicism, but sometimes I wonder if the pushes for HTTPS-everywhere, certificate transparency and DoH are really more for the privacy of app developers instead of the privacy of users...

If you care about the privacy of users, you need software that the user controls, not the developer. Therefore free software.

Re: Tracking my phone's silent connections

#18

Post by sdwisely »

saagarjha wrote: post #16

It’s surprising to see that many HTTP connections, considering that Apple has been pushing somewhat hard for apps to migrate to HTTPS connections…

from memory they recently wontfix'ed some issues about this saying they leave things like updates on http so they can be cached on corporate networks.

Re: Tracking my phone's silent connections

#19

Post by mox1 »

Nextgrid wrote: post #13
mox1 wrote: post #8

Earlier quoted context omitted.

Same for Apple, I've had to bypass this multiple times for pen testing engagements. There are ready to use modules to patch it out, no root / jailbreaking required. There is lots of good security reasons to do this. Further, if they didn't people would just roll a Swift / OBj-C SSL library and do it all themselves, which would be worse I think.

Are you talking about iOS? What solutions exist to bypass certificate pinning without jailbreaking?

Yes, A tool called Objection can do it. You have to modify and re-sign the app you are interested in bypassing. Requires a developer account and the .ipa of the app you want to work with.

https://github.com/sensepost/objection

Re: Tracking my phone's silent connections

#20

Post by Dahoon »

That is a great idea. I'm going to try this myself on my Android phone (though ads etc. are already blocked on it). Might be a good way to put a tripwire up to catch if anything suspicious happens.

EDIT: OpenWRT's adblock package (which I already used) can create a DNS report and each list has a Blacklist/Whitelist button. Superb!

Post reply on HN