Cracking Meta's Messenger Certificate Pinning on macOS
1–10 of 136 posts
Re: Cracking Meta's Messenger Certificate Pinning on macOS
#2Okay why just use the web interface and intercept that
Re: Cracking Meta's Messenger Certificate Pinning on macOS
#3[flagged]
Re: Cracking Meta's Messenger Certificate Pinning on macOS
#4[flagged]
Cracking (abbreviated “[k]”) is the term of art for making small modifications to a compiled binary to toggle functionality (usually disabling license/serial checks, but in this case cert pinning).
This usage is completely consistent with the typical and is well in-bounds.
Re: Cracking Meta's Messenger Certificate Pinning on macOS
#5[flagged]
Cracking (abbreviated “[k]”) is the term of art for making small modifications to a compiled binary to toggle functionality (usually disabling license/serial checks, but in this case cert pinning). This usage is completely consistent with the typical and is well in-bounds.
Cracking is also used to refer to converting some obfuscated secret to plaintext, most commonly in reference to passwords.
So I can understand the confusion
Re: Cracking Meta's Messenger Certificate Pinning on macOS
#6[flagged]
[deleted]
Re: Cracking Meta's Messenger Certificate Pinning on macOS
#7Very clever way of doing this (though I have a feeling you could probably enforce pinning even in sandboxed mode). I remember trying to MitM Snapchat back in college and couldn't figure it out as they were also using cert pinning.
Re: Cracking Meta's Messenger Certificate Pinning on macOS
#8Ha, I found myself going down a similar route and threw in the towel once I was trying to decompile/edit/recompile. This is dedication, would love to know the hours involved. I set myself a cutoff and stuck to it.
Re: Cracking Meta's Messenger Certificate Pinning on macOS
#9Very clever way of doing this (though I have a feeling you could probably enforce pinning even in sandboxed mode). I remember trying to MitM Snapchat back in college and couldn't figure it out as they were also using cert pinning.
Fundamentally, it’s hard to enforce certificate pinning if the user can modify the binary. Even if sandbox mode used certificate pinning, there would likely be some other way of removing the pinned cert checks.
Re: Cracking Meta's Messenger Certificate Pinning on macOS
#10Ha, I found myself going down a similar route and threw in the towel once I was trying to decompile/edit/recompile. This is dedication, would love to know the hours involved. I set myself a cutoff and stuck to it.
This was initially an internal post at Texts.com that we decided to share, and I scrapped mention of the fact I had tried the exact same approach a few weeks prior and reached my time-box as well.
I initially spent two hours trying to modify different instructions, and then gave up. I saw another blog post written by a reverse engineer by the name of "Hassan Mostafa" (aka cyclon3) that previously succeeded in the same approach (taking Hopper Disassembler to Instagram on iOS) and I was inspired to try again that night, but I had no luck. I even found and attempted to modify the same instructions.
I decided to call it quits, and then a few weeks later with a bit of a grudge, I spontaneously tried again and I had it done in about 30 minutes after finding the sandbox function.