[dead]
Cracking Meta's Messenger Certificate Pinning on macOS
51–60 of 136 posts
Re: Cracking Meta's Messenger Certificate Pinning on macOS
#52Earlier quoted context omitted.
And if spying works without using the microphone or whatever, the alternative is almost worse - it means Meta et al has such a good virtual “mind reading” Skinner model of you that they have a good hunch of what you will talk and think about. If we are not there yet, it’s only a matter of time with enough machine learning…
This is always what has screwed with me the most about this AdTech thought experiment: Both likelihoods (listening-in vs astute prediction models) are equally bad; and whoever downplays either as "business as usual" or "humans are predictable", respectively, ought to be called out for it. It's NOT good when you listen to conversations without explicit (or implied, for that matter) consent, just as it's equally NOT go…
My hypothesis is that it's not listening nor is it predicting based on the individual, instead it's reacting to web surfing behaviors of your associates.
For example, you and your partner use the same wifi at home a lot, and you both visit a close friend's house and use their wifi every time you're there. Services that you use in both places (e.g. Facebook, Google) now have a graph where there's a very strong link between you and your partner, and a weaker but still important link between the two residential IP addresses.
Now you're at home, just had dinner with your partner, and you say you are considering buying a guitar. An hour later you open your phone and see ads for guitars. "Honey, did you search for guitars already?" "No, why?" "Oh no! It heard me! Or it knows me too well! Uninstall all your apps!"
No, what happened is that last night you were at that friend's house, told your friend about your guitar desires, and all morning that friend has been doing a bit of market research themselves, perhaps to see what you're on about and maybe consider getting it for you. The graph connects the dots, and advertisers suspect that perhaps guitar ads should go not only to your friend, but also to you (by that weak association) just in case you might be the one who buys the guitar.
The uncanniness is a function of you having no idea that your friend was building up this slight likelihood that you're about to buy a guitar, combined with even a very weak signal poking out above the noise given no other recent signals.
Re: Cracking Meta's Messenger Certificate Pinning on macOS
#53I can see an argument that software's communication over the network must be inspectable by the owner of the hardware.
Re: Cracking Meta's Messenger Certificate Pinning on macOS
#54I can see an argument that software's communication over the network must be inspectable by the owner of the hardware.
[deleted]
Re: Cracking Meta's Messenger Certificate Pinning on macOS
#55Would a runtime binary checksum have helped to complicate such modification? This isn’t sop for mobile apps? Do iOS or Android SDK’s provide such facilities? Presumably associated with the official release process and enforced on their respective non-jailbroken platforms? Basic questions, admittedly. Just noticed that the final solution was to simply modify a few bytes of the binary, which seemed preventable.
You have to resign the binary when you modify anyway which achieves the same thing.
On non-jailbroken platforms you generally do this with a developer certificate.
Re: Cracking Meta's Messenger Certificate Pinning on macOS
#56I'm really glad this is possible, because it's important for dispelling conspiracy theories. Plenty of people are convinced that Facebook's apps spy on them through their microphone and use that to show them targeted ads. The easiest way to disprove this is to monitor the traffic between the apps and Facebook's servers... but certificate pinning prevents this! (Not that anyone who believes this can ever be talked out…
[deleted]
Re: Cracking Meta's Messenger Certificate Pinning on macOS
#57There's no point in implementing cert pinning if you don't also have integrity checking... Being able to alter bytes in the physical file and running it should not be possible (without another bypass).
Cert pinning protects against compromised certificate authorities. There are hundreds of trusted root certificates in most operating system stores so one of them gets breached every once and a while. Integrity checking is user-hostile, but certificate pinning can be good for users.
I don't know which users integrity checking the executable would be hostile against. But, I see your point that perhaps their reason for cert pinning is to defend against compromised CAs. It does fit the narrative better with their lack of obfuscation and other layers of defense on their app.
Re: Cracking Meta's Messenger Certificate Pinning on macOS
#58Earlier quoted context omitted.
Cert pinning protects against compromised certificate authorities. There are hundreds of trusted root certificates in most operating system stores so one of them gets breached every once and a while. Integrity checking is user-hostile, but certificate pinning can be good for users.
I don't know which users integrity checking the executable would be hostile against. But, I see your point that perhaps their reason for cert pinning is to defend against compromised CAs. It does fit the narrative better with their lack of obfuscation and other layers of defense on their app.
Stopping users from modifying the software they run is user hostile.
Re: Cracking Meta's Messenger Certificate Pinning on macOS
#59Earlier quoted context omitted.
This is always what has screwed with me the most about this AdTech thought experiment: Both likelihoods (listening-in vs astute prediction models) are equally bad; and whoever downplays either as "business as usual" or "humans are predictable", respectively, ought to be called out for it. It's NOT good when you listen to conversations without explicit (or implied, for that matter) consent, just as it's equally NOT go…
My hypothesis is that it's not listening nor is it predicting based on the individual, instead it's reacting to web surfing behaviors of your associates. For example, you and your partner use the same wifi at home a lot, and you both visit a close friend's house and use their wifi every time you're there. Services that you use in both places (e.g. Facebook, Google) now have a graph where there's a very strong link be…
My theory is that we're all just WAY less interesting than we think we are.
Male, 40+? A bit more likely than the average human to have a mini mid-life crisis and decide to buy an electric guitar.
These platforms suggest SO many ads to us that even if 99% of the suggestions are total junk that we ignore without even registering, the 1% that represent a lucky roll of the dice still really stick in our memories.
Re: Cracking Meta's Messenger Certificate Pinning on macOS
#60Earlier quoted context omitted.
This was initially an internal post at Texts.com that we decided to share, and I scrapped mention of the fact I had tried the exact same approach a few weeks prior and reached my time-box as well. I initially spent two hours trying to modify different instructions, and then gave up. I saw another blog post written by a reverse engineer by the name of "Hassan Mostafa" (aka cyclon3) that previously succeeded in the sam…
Ok, that makes sense! Sometimes when you read a blog post that is well written and cogent it makes it feel like the author did it in 20 min! If I end up in the same arena I think I’ll look for debugging code next. I love certificate pinning as a user, but as a forensic analyst I fucking loath it.
Even as a user I don’t there’s a good reason to love cert pinning. If you’re going up against adversaries that can compromise web pki they also probably have some other exploits up their sleeve to pwn you.
Cert pinning pretty much serves to protect companies from people reversing their protocols and little else imo.