Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Cracking Meta's Messenger Certificate Pinning on macOS

texts.blog

Post reply on HN
Print view View original

11–20 of 136 posts

Re: Cracking Meta's Messenger Certificate Pinning on macOS

#11

Post by sneak »

I remember the first time I ever cracked an app, I was so convinced I would fail, but it turns out that finding these sorts of easy-to-modify JNE/JEZ spots is easier than it seems. Even if you pick wrong you can just revert to the original file and try a different spot.

I imagine this would be something that AI will be able to do easily in an automated fashion, you can literally just try flipping the JEZ/JNZ in a bunch of candidate spots and launching the app and seeing if the nag screen comes up.

Re: Cracking Meta's Messenger Certificate Pinning on macOS

#12

Post by bevekspldnw »

ridafkih wrote: post #10
bevekspldnw wrote: post #8

Ha, I found myself going down a similar route and threw in the towel once I was trying to decompile/edit/recompile. This is dedication, would love to know the hours involved. I set myself a cutoff and stuck to it.

This was initially an internal post at Texts.com that we decided to share, and I scrapped mention of the fact I had tried the exact same approach a few weeks prior and reached my time-box as well. I initially spent two hours trying to modify different instructions, and then gave up. I saw another blog post written by a reverse engineer by the name of "Hassan Mostafa" (aka cyclon3) that previously succeeded in the sam…

Ok, that makes sense! Sometimes when you read a blog post that is well written and cogent it makes it feel like the author did it in 20 min!

If I end up in the same arena I think I’ll look for debugging code next. I love certificate pinning as a user, but as a forensic analyst I fucking loath it.

Re: Cracking Meta's Messenger Certificate Pinning on macOS

#13

Post by detourdog »

4death4 wrote: post #9
dvt wrote: post #7

Very clever way of doing this (though I have a feeling you could probably enforce pinning even in sandboxed mode). I remember trying to MitM Snapchat back in college and couldn't figure it out as they were also using cert pinning.

Fundamentally, it’s hard to enforce certificate pinning if the user can modify the binary. Even if sandbox mode used certificate pinning, there would likely be some other way of removing the pinned cert checks.

This is a large part of Apple's control/Secure Enclave decisions. These decisions can seem arbitrary and anti-completive from the outside.

Re: Cracking Meta's Messenger Certificate Pinning on macOS

#14

Post by dvt »

4death4 wrote: post #9
dvt wrote: post #7

Very clever way of doing this (though I have a feeling you could probably enforce pinning even in sandboxed mode). I remember trying to MitM Snapchat back in college and couldn't figure it out as they were also using cert pinning.

Fundamentally, it’s hard to enforce certificate pinning if the user can modify the binary. Even if sandbox mode used certificate pinning, there would likely be some other way of removing the pinned cert checks.

> there would likely be some other way of removing the pinned cert checks

Yes, but it's significantly harder than flipping a bit. There's also clever ways of countering this (e.g. checksumming the public key). Of course, even this is technically hackable, but extremely time-consuming in practice. Imagine getting the public key and adding a bunch (and by a bunch, I mean like 16k) of random ops throughout the control flow that crash the app if any random byte of the key is wrong. For extra fun, offset the byte by the instruction pointer. Good luck debugging that.

Re: Cracking Meta's Messenger Certificate Pinning on macOS

#15

Post by Thaxll »

4death4 wrote: post #9
dvt wrote: post #7

Very clever way of doing this (though I have a feeling you could probably enforce pinning even in sandboxed mode). I remember trying to MitM Snapchat back in college and couldn't figure it out as they were also using cert pinning.

Fundamentally, it’s hard to enforce certificate pinning if the user can modify the binary. Even if sandbox mode used certificate pinning, there would likely be some other way of removing the pinned cert checks.

It prevents very basic RE / MITM.

Re: Cracking Meta's Messenger Certificate Pinning on macOS

#16

Post by julkali »

dvt wrote: post #7

Very clever way of doing this (though I have a feeling you could probably enforce pinning even in sandboxed mode). I remember trying to MitM Snapchat back in college and couldn't figure it out as they were also using cert pinning.

I tried the same thing, and while I managed to patch the application and intercept the requests, I gave up when trying to RE the shared object responsible for request signing. I couldn't even find the entry point. For a relatively small social media app they had insane security already back in 2015.

Re: Cracking Meta's Messenger Certificate Pinning on macOS

#17

Post by ridafkih »

julkali wrote: post #16
dvt wrote: post #7

Very clever way of doing this (though I have a feeling you could probably enforce pinning even in sandboxed mode). I remember trying to MitM Snapchat back in college and couldn't figure it out as they were also using cert pinning.

I tried the same thing, and while I managed to patch the application and intercept the requests, I gave up when trying to RE the shared object responsible for request signing. I couldn't even find the entry point. For a relatively small social media app they had insane security already back in 2015.

Snapchat and TikTok both boast pretty gnarly RE-prevention measures.

Re: Cracking Meta's Messenger Certificate Pinning on macOS

#18

Post by saagarjha »

julkali wrote: post #16
dvt wrote: post #7

Very clever way of doing this (though I have a feeling you could probably enforce pinning even in sandboxed mode). I remember trying to MitM Snapchat back in college and couldn't figure it out as they were also using cert pinning.

I tried the same thing, and while I managed to patch the application and intercept the requests, I gave up when trying to RE the shared object responsible for request signing. I couldn't even find the entry point. For a relatively small social media app they had insane security already back in 2015.

Snap has always had pretty beefy client security. Since, of course, a hacked client breaks the entire premise of their app.

Re: Cracking Meta's Messenger Certificate Pinning on macOS

#19

Post by saagarjha »

detourdog wrote: post #13
4death4 wrote: post #9

Earlier quoted context omitted.

Fundamentally, it’s hard to enforce certificate pinning if the user can modify the binary. Even if sandbox mode used certificate pinning, there would likely be some other way of removing the pinned cert checks.

This is a large part of Apple's control/Secure Enclave decisions. These decisions can seem arbitrary and anti-completive from the outside.

This seems unrelated?
Post reply on HN