Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Cracking Meta's Messenger Certificate Pinning on macOS

texts.blog

Post reply on HN
Print view View original

91–100 of 136 posts

Re: Cracking Meta's Messenger Certificate Pinning on macOS

#91

Post by charcircuit »

fireattack wrote: post #90
charcircuit wrote: post #89

Earlier quoted context omitted.

That line of thinking leads you to the path where users are free to install malware and give it all the capabilities it needs because the user chose to do so.

Yes, if the user want to disable all the protections and choose to install malware it's their choice. You can already do so on *nix, Windows, and macOS (albeit more complicated). Not sure why a phone OS would be different. Your line of thinking is basically "think of the children".

>Not sure why a phone OS would be different.

As a new platform that does not have to worry about backwards compatibility they can better design the operating system with lessons learned over the years that desktops have existed.

>Your line of thinking is basically "think of the children".

My line of thinking is that with proper design a platform can have good security. The web platform got sandboxing right. It's a good thing that a website can not cryptolock all your files by just visiting it. Does a website really need to be able to read and write all the files on your system, or perhaps is exposing just a single folder dedicated to the site good enough for most legitimate purposes. A platform can choose what kind of apps it should support. I don't think it is bad for a platform to decide that it does not want to support the needs of a cryptolocker even if that may be limiting what a user can do.

I don't believe that "think[ing] of [user's security]" is a bad thing. User security is valuable for a platform and is essential for scaling.

Re: Cracking Meta's Messenger Certificate Pinning on macOS

#92

Post by buildfocus »

charcircuit wrote: post #89
fireattack wrote: post #88

Earlier quoted context omitted.

I get it, but that's ultimately the user's choice.

That line of thinking leads you to the path where users are free to install malware and give it all the capabilities it needs because the user chose to do so.

...yes.

Unavoidable hard restrictions like this make it dramatically harder to do malware research (thereby reducing security overall) and cause huge & unreasonable problems the moment you see a false positive.

I'm all for user protection, but there is a limit. There's no point aiming for 'impossible' - if the user could be convinced past enough security warnings in the OS, they can equally be convinced to just type their banking passwords into the attacker's phone directly.

I think there's a responsibility on the platform to make possible consequences clear, and make dangerous actions quite difficult, but totally blocking full user control of their own devices is counter productive.

Re: Cracking Meta's Messenger Certificate Pinning on macOS

#94

Post by rollulus »

This made me think back of the days of +Orc [1]. I believe a lot of knowledge common back then, like how to find and nop out an undesired branch, has been lost. Which is fair, there’s way more other tech to learn nowadays.

[1]: https://en.m.wikipedia.org/wiki/Old_Red_Cracker

Re: Cracking Meta's Messenger Certificate Pinning on macOS

#95

Post by no_time »

detourdog wrote: post #13
4death4 wrote: post #9

Earlier quoted context omitted.

Fundamentally, it’s hard to enforce certificate pinning if the user can modify the binary. Even if sandbox mode used certificate pinning, there would likely be some other way of removing the pinned cert checks.

This is a large part of Apple's control/Secure Enclave decisions. These decisions can seem arbitrary and anti-completive from the outside.

I wouldn't call it anti-competitive. Treacherous is a more apt description.

https://www.gnu.org/philosophy/can-you-trust.html

Re: Cracking Meta's Messenger Certificate Pinning on macOS

#96

Post by no_time »

charcircuit wrote: post #89
fireattack wrote: post #88

Earlier quoted context omitted.

I get it, but that's ultimately the user's choice.

That line of thinking leads you to the path where users are free to install malware and give it all the capabilities it needs because the user chose to do so.

Are you also in favor of passing a law that prohibits selling knives because they might cut their owner?

Re: Cracking Meta's Messenger Certificate Pinning on macOS

#97

Post by charcircuit »

no_time wrote: post #96
charcircuit wrote: post #89

Earlier quoted context omitted.

That line of thinking leads you to the path where users are free to install malware and give it all the capabilities it needs because the user chose to do so.

Are you also in favor of passing a law that prohibits selling knives because they might cut their owner?

No, but if someone made a knife that was unable to cut their owner I would expect it to have a competitive advantage in the marketplace against a normal knife.

Re: Cracking Meta's Messenger Certificate Pinning on macOS

#98

Post by pests »

tnmom wrote: post #77
10000truths wrote: post #72

Earlier quoted context omitted.

Asymmetric encryption is very computationally expensive - there's a reason that it's typically only feasible to use for signing a hash or as part of a key exchange to agree upon a shared symmetric key.

Envelope encryption works for that - client generates a random symmetric key, encrypts the data symmetrically, then asymmetrically encrypts just the key (which is then thrown away on the client). Both the symmetrically encrypted body and asymmetrically encrypted key are sent.

You just modify the client to leak the data before it's encrypted symmetrically. Keys don't matter at that point.

Re: Cracking Meta's Messenger Certificate Pinning on macOS

#99

Post by thaumasiotes »

callalex wrote: post #66
julkali wrote: post #16

Earlier quoted context omitted.

I tried the same thing, and while I managed to patch the application and intercept the requests, I gave up when trying to RE the shared object responsible for request signing. I couldn't even find the entry point. For a relatively small social media app they had insane security already back in 2015.

Snapchat’s founding principle and only differentiator from day one has been untrusted client security. There were way too many years where the general public believed that a Snapchat could not be saved. I give huge credit to Snapchat for accidentally teaching the public that if human eyeballs can see something, it can be recorded forever. Now that is taken for granted, even last week’s Saturday Night Live TV sketch r…

What? That wasn't a principle of theirs. They explicitly exclude "screenshot detection avoidance" from their bug bounty policy: https://hackerone.com/snapchat?type=team . They always have. As far as they're concerned, that's not a security issue.

Re: Cracking Meta's Messenger Certificate Pinning on macOS

#100

Post by rockbruno »

protoman3000 wrote: post #24

How come applications from such big players are not completely obfuscated and have all kinds of other protections in them to e.g. deny modified binaries from running?

Because doing so is pointless for a mobile/front-end app. The attacker has physical access to the device; there's no way to stop them at this point. The only thing you can do is make the process more annoying in hopes that they will get frustrated and give up.
Post reply on HN