Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Charles Proxy now available on iOS

charlesproxy.com

Post reply on HN
Print view View original

31–40 of 113 posts

Re: Charles Proxy now available on iOS

#31

Post by saagarjha »

nstj wrote: post #29
saagarjha wrote: post #26

Earlier quoted context omitted.

I've never done this personally, but I'm pretty sure there is no way to protect against hooking and/or patching functions in Secure Transport (iOS's low-level TLS stack), since all network traffic goes through these APIs. I'm sure there's something similar in Android.

Sure, but then you'd have to JB the phone. Most of this stuff is pretty straightforward, but not exactly 'trivial' - especially given the context is an iOS app specifically aimed at making MITM easier.

Certificate pinning is inherently security by obscurity; it's intended as an annoyance for anyone trying to reverse-engineer the service, rather than an insurmountable barrier.

Re: Charles Proxy now available on iOS

#32

Post by dannyw »

saagarjha wrote: post #31
nstj wrote: post #29

Earlier quoted context omitted.

Sure, but then you'd have to JB the phone. Most of this stuff is pretty straightforward, but not exactly 'trivial' - especially given the context is an iOS app specifically aimed at making MITM easier.

Certificate pinning is inherently security by obscurity; it's intended as an annoyance for anyone trying to reverse-engineer the service, rather than an insurmountable barrier.

Certificate pinning is also a secure way of protecting against MITM attacks, mis-issued certs, and enterprise proxies.

Re: Charles Proxy now available on iOS

#33

Post by dannyw »

nstj wrote: post #19
reagan83 wrote: post #16

Earlier quoted context omitted.

Can you describe what this means?

Charles works by sitting between a server and a phone. It decrypts traffic from the server, displays this to the user to 'inspect', and then re-encrypts the traffic to be sent to the phone. It re-encrypts the traffic using its own SSL certificate (technically a CA, but no need to get bogged down in details). In many modern apps, code has been added such that an app will only accept traffic which has been encrypted by…

The reason for this is primarily to protect against MITM attacks by a hostile network and rogue CA, enterprise proxies, etc.

Re: Charles Proxy now available on iOS

#34

Post by yodon »

Genuine question here: How is it not absolutely terrifying that an iOS App Store app can man in the middle HTTPS communications made by other apps? Is there some way in which this isn’t poking a hole in exactly the sort of security sandbox that iOS tends to be good at? (And yes there probably is some part of what’s going on that I don’t understand, that’s why I’m asking the question)

Re: Charles Proxy now available on iOS

#35

Post by simcop2387 »

yodon wrote: post #34

Genuine question here: How is it not absolutely terrifying that an iOS App Store app can man in the middle HTTPS communications made by other apps? Is there some way in which this isn’t poking a hole in exactly the sort of security sandbox that iOS tends to be good at? (And yes there probably is some part of what’s going on that I don’t understand, that’s why I’m asking the question)

Can't say much about the security, but I suspect it's working by pretending to be a VPN provider and then proxying the traffic. It's then able to install a CA root to generate any certs it needs to MITM traffic. Cert pinning will prevent this from working, but that's the only thing that will.

Re: Charles Proxy now available on iOS

#37

Post by bigiain »

nstj wrote: post #30
bigiain wrote: post #28

Earlier quoted context omitted.

Then Geotrust, in a petulant hissyfit, email ~20,000 of their customers private keys to DigiTrust - and the carefully laid plans of updating the app with newer ssl certs pinned 12 and 6 months in advance of expiry are - ummmm - revealed to be flawed... Hilarity ensues.

Well, the certs don't _have_ to be shipped with the app, there are workarounds to refresh the certs without sending out a whole new app binary.

Yep - but guess what wasn't done in this case...

(Yes, this is a still-trying-to-fix-it real world event... Glad it's not my problem, just one I hear about from people I used to work with...)

Re: Charles Proxy now available on iOS

#38

Post by yodon »

simcop2387 wrote: post #35
yodon wrote: post #34

Genuine question here: How is it not absolutely terrifying that an iOS App Store app can man in the middle HTTPS communications made by other apps? Is there some way in which this isn’t poking a hole in exactly the sort of security sandbox that iOS tends to be good at? (And yes there probably is some part of what’s going on that I don’t understand, that’s why I’m asking the question)

Can't say much about the security, but I suspect it's working by pretending to be a VPN provider and then proxying the traffic. It's then able to install a CA root to generate any certs it needs to MITM traffic. Cert pinning will prevent this from working, but that's the only thing that will.

Supposed sandboxing against malicious apps is precisely why I run iOS rather than Android. I get that Charles isn’t malicious, but what’s keeping any random free game app from doing the same thing? (Again, intended as a real question not a rhetorical one)

Re: Charles Proxy now available on iOS

#39

Post by [deleted] »

yodon wrote: post #38
simcop2387 wrote: post #35

Earlier quoted context omitted.

Can't say much about the security, but I suspect it's working by pretending to be a VPN provider and then proxying the traffic. It's then able to install a CA root to generate any certs it needs to MITM traffic. Cert pinning will prevent this from working, but that's the only thing that will.

Supposed sandboxing against malicious apps is precisely why I run iOS rather than Android. I get that Charles isn’t malicious, but what’s keeping any random free game app from doing the same thing? (Again, intended as a real question not a rhetorical one)

[deleted]

Re: Charles Proxy now available on iOS

#40

Post by ce4 »

simcop2387 wrote: post #35
yodon wrote: post #34

Genuine question here: How is it not absolutely terrifying that an iOS App Store app can man in the middle HTTPS communications made by other apps? Is there some way in which this isn’t poking a hole in exactly the sort of security sandbox that iOS tends to be good at? (And yes there probably is some part of what’s going on that I don’t understand, that’s why I’m asking the question)

Can't say much about the security, but I suspect it's working by pretending to be a VPN provider and then proxying the traffic. It's then able to install a CA root to generate any certs it needs to MITM traffic. Cert pinning will prevent this from working, but that's the only thing that will.

Client certificates will prevent it too.
Post reply on HN