Earlier quoted context omitted.
This seems unrelated?
I saw is as related by an entities ability to control certificates on platforms with zero trust.
Apple designs the platform, though. Seems like a different model to me?
Cracking Meta's Messenger Certificate Pinning on macOS
111–120 of 136 posts
Re: Cracking Meta's Messenger Certificate Pinning on macOS
#112I am curious about the legality of this. I guess I assumed that doing this type of thing would technically a DCMA type breech? So this makes me wonder if my assumption wrong? How does this work legally?
It's typically against terms of service to decompile or reverse engineer applications you download in this way, but it's also typically against terms of service to use their services from unofficial clients, so I think they're already way past T&Cs.
Re: Cracking Meta's Messenger Certificate Pinning on macOS
#113I did something similar for Instagram on android few years ago. The usual methods for bypassing certificate didn't work on Instagram, they were statically linking openssl into a shared library called libcoldstart.so. I Spent some time reading openssl documentation and ended up installing a hook to the function that configured the certificate verification.
In case you are curious. I used Frida for installing hooks to native functions.
Re: Cracking Meta's Messenger Certificate Pinning on macOS
#114You don't really need to do that if you want to intercept Meta apps traffic. https://www.facebook.com/whitehat/bugbounty-education/261571...
This only works on Android, we had no interest in intercepting the Android application.
Out of interest, why not? I've needed to reverse engineer APIs in the past and using Android apps was always much easier so we always did that when the APIs were available.
Re: Cracking Meta's Messenger Certificate Pinning on macOS
#115Earlier quoted context omitted.
I saw is as related by an entities ability to control certificates on platforms with zero trust.
Apple designs the platform, though. Seems like a different model to me?
Exactly I was pointing out why some may choose certain models. I would say that building a platform takes many considerations and the choices made led to this outcome. Apple made different choices and is often vilified for trying to maintain these protections.
Apple has been slowly making progress of opening up their platform. The next 3 years will introduce a new landscape for apps. People will still be complaining.
Re: Cracking Meta's Messenger Certificate Pinning on macOS
#116Earlier quoted context omitted.
Eh, clearly it raises the barrier to entry significantly. You’re never safe from a truly determined adversary, but you can keep out the riff raff.
Perhaps I'm a bit harsh... but my suggestion to fortune 500 tech company remains. Implement integrity validation as well, otherwise all it takes is editing 2 bytes to bypass your ssl pinning.
Cool idea! Now it takes 2 bytes to bypass integrity validation, and 2 bytes to bypass cert pinning. (4 bytes in total)
Re: Cracking Meta's Messenger Certificate Pinning on macOS
#117This made me think back of the days of +Orc [1]. I believe a lot of knowledge common back then, like how to find and nop out an undesired branch, has been lost. Which is fair, there’s way more other tech to learn nowadays. [1]: https://en.m.wikipedia.org/wiki/Old_Red_Cracker
I always feel nostalgic when I see references to +Orc, or Fravia (RIP).
But I think there's still a lot of people doing the NOP-patching thing, albeit with more complexity. There continue to be people breaking DRM, and investigating random [mobile] apps with hex-editors & etc.
It's harder to get started these days as programs are more complex, but at the same time the knowledge required is more accessible.
Re: Cracking Meta's Messenger Certificate Pinning on macOS
#118Earlier quoted context omitted.
Ok, that makes sense! Sometimes when you read a blog post that is well written and cogent it makes it feel like the author did it in 20 min! If I end up in the same arena I think I’ll look for debugging code next. I love certificate pinning as a user, but as a forensic analyst I fucking loath it.
Even as a user I don’t there’s a good reason to love cert pinning. If you’re going up against adversaries that can compromise web pki they also probably have some other exploits up their sleeve to pwn you. Cert pinning pretty much serves to protect companies from people reversing their protocols and little else imo.
If it’s managed well, certificate pinning takes the web PKI out of the implicit trust envelope for your app.
From a pure security perspective, why trust someone you don’t have to trust? The web PKI CA bundle is great for cases where it’s hard to have a unique trust root for your application - like you’re running in a browser with no privileges - but if you’re distributing code then you’ve already solved that problem.
Managed well, it should be completely transparent to users as well. Managed poorly and it can be catastrophic (your app is dead until users upgrade it).
Re: Cracking Meta's Messenger Certificate Pinning on macOS
#119Earlier quoted context omitted.
Snapchat and TikTok both boast pretty gnarly RE-prevention measures.
For the uninitiated: TikTok is known to send and receive telemetry packages through headers in other requests (IIRC), and employs the use of a virtual machine(!) to execute encrypted client code.
Any source for that? What does "other" requests mean? Other than what? I doubt it could modify the headers of other apps.
Re: Cracking Meta's Messenger Certificate Pinning on macOS
#120I did something similar for Instagram on android few years ago. The usual methods for bypassing certificate didn't work on Instagram, they were statically linking openssl into a shared library called libcoldstart.so. I Spent some time reading openssl documentation and ended up installing a hook to the function that configured the certificate verification. In case you are curious. I used Frida for installing hooks to…
[deleted]