21–30 of 30 posts
I used Charles to help me get endpoints for controlling my automatic cat toilet. The Chinese based iOS app was horrible to use and who knows what data it collected. After getting the endpoints, I was able to plug it directly into Home assistant.
I'd like to think this is a satire of the Internet of Shit^H^H^H^H Things. But I doubt it.
You never know with corporations. Consequences range from "federal pound-in-the-ass prison" or "here is $500".
Care to explain your use of this term?
You never know with corporations. Consequences range from "federal pound-in-the-ass prison" or "here is $500".
> pound-in-the-ass prison Care to explain your use of this term?
> Geofence bypass: As far as I understand, there's no easy way to enforce a geofence server-side other than timing, consistency, etc. You sort of just have to trust whatever the phone tells you. There's no fool proof method but you can make it very hard and impractical. Both Apple and Google offer attestation mechanisms to confirm the integrity of the App and Device Environment that it's running on. This ensures that…
Apparently you can get dongles for iPhones to do GPS spoofing, because apparently(?) iOS can take an external GPS source(?!?).
> Geofence bypass: As far as I understand, there's no easy way to enforce a geofence server-side other than timing, consistency, etc. You sort of just have to trust whatever the phone tells you. There's no fool proof method but you can make it very hard and impractical. Both Apple and Google offer attestation mechanisms to confirm the integrity of the App and Device Environment that it's running on. This ensures that…
1. This was not a mitm attack, it was lawful mitm inspection of a user's own traffic. Mitm attacks are prevented by TLS and the system CA store already. 2. Please don't give people bad ideas. This is how we get bikeshare apps that don't work on rooted/old/GrapheneoOS/... devices and further entrench google's position in the Android ecosystem. If your security depends on devices faithfully reporting their location, yo…
My intent was not to color or frame the activity but to use shared understood knowledge to convey the concept. It's like the terms blacklist and whitelist. Yes they're rooted in racism, and gosh darn it if everyone doesn't still use them because we know immediately what they are and there no better term. On the flip side we successfully switched from master to main.
If you don't want people saying "mitm attack" you gotta come up with something that rolls off the tongue a little better than "it was lawful mitm inspection of a user's own traffic".
> Geofence bypass: As far as I understand, there's no easy way to enforce a geofence server-side other than timing, consistency, etc. You sort of just have to trust whatever the phone tells you. There's no fool proof method but you can make it very hard and impractical. Both Apple and Google offer attestation mechanisms to confirm the integrity of the App and Device Environment that it's running on. This ensures that…
There are attestation mechanisms, but huge portions of a public user-base (especially android) don't pass that check because their device is too old, or their OEM sucked, or something something mediatek SOC, or In my experience, all forms of attestation start to become impractical at scale unless you have a fairly homogeneous, well-patched fleet. This is particularly heinous for TPMs, where I've observed TPMs coming…
I was simply pointing out that there are mechanisms that exist today one could use to better secure critical functions.
Earlier quoted context omitted.
Believe it or not, straight to jail! Just kidding, great writeup. I know it's not groundbreaking, but does surprise me how many products don't bother with rate limiting controls.
i actually think a quick-fix was setting a rate limit. which sadly thwarted my brute-forcing, but did not actually fix the race condition itself. though it's a very fair "kid, stop it" response until they fixed the race condition.
Earlier quoted context omitted.
1. This was not a mitm attack, it was lawful mitm inspection of a user's own traffic. Mitm attacks are prevented by TLS and the system CA store already. 2. Please don't give people bad ideas. This is how we get bikeshare apps that don't work on rooted/old/GrapheneoOS/... devices and further entrench google's position in the Android ecosystem. If your security depends on devices faithfully reporting their location, yo…
> This was not a mitm attack My intent was not to color or frame the activity but to use shared understood knowledge to convey the concept. It's like the terms blacklist and whitelist. Yes they're rooted in racism, and gosh darn it if everyone doesn't still use them because we know immediately what they are and there no better term. On the flip side we successfully switched from master to main. If you don't want peop…
And no, most people at least in the reverse engineering circles I'm in/follow, don't say "MiTM attack" when things are done by the user with consent. I've heard MiTM-ing as a verb, MiTM/SSL/TLS proxying/inspection/interception or even (incorrectly) SSL stripping (and surely some more that I don't remember).
Earlier quoted context omitted.
There are attestation mechanisms, but huge portions of a public user-base (especially android) don't pass that check because their device is too old, or their OEM sucked, or something something mediatek SOC, or In my experience, all forms of attestation start to become impractical at scale unless you have a fairly homogeneous, well-patched fleet. This is particularly heinous for TPMs, where I've observed TPMs coming…
That's a fair and valid point. Those are concessions that would need to be measured, impact analysis done, and decisions discussed on an ARB meeting. I was simply pointing out that there are mechanisms that exist today one could use to better secure critical functions.