4 ms·

Reverse-Engineering iOS Apps: Hacking on Lyft

171 points by timanglade 11y ago

_krug 11y ago
Video is not working... Video is hosted with 'wistia' and the ID is 52endf5e4h, can someone stitch together a working URL? I'm on mobile
- kristofferR 11y ago
  https://embed-ssl.wistia.com/deliveries/6504b8003517d6b2fabdee02312ebf33703e0bd9/file.mp4 https://embed-ssl.wistia.com/deliveries/6504b8003517d6b2fabd...
- ckurose 11y ago
  Worked fine for me on mobile (chrome on iOS)... What browser are you using?
deleted 11y ago
[deleted]
deleted 11y ago
[deleted]
jonesb6 11y ago
Great video, worth watching even on mobile IMO.
cellularmitosis 11y ago
Terminal addicts will enjoy the ncurses-based mitmproxy as an alternative to Charles.
- scintill76 11y ago
  Or maybe cheapskates, since technically you're supposed to buy Charles after a 30-day trial (which didn't attempt to enforce itself in my experience.) I like Fiddler2 on Windows, and I almost had it working well on Wine/Linux, but had some issues with SSL. I should try mitmproxy for the SSL and Fiddler for the UI, but lately I haven't needed a proxy.
- maqr 11y ago
  I just made the switch from Charles to mitmproxy. The only issue I've found with it so far is that it seems really slow in returning responses. I'm not doing anything crazy with it either, but Charles was getting content to the device way faster.
michaelbuckbee 11y ago
I keep hearing rumors that Apple and Google are going to require that app developers start pinning SSL certs as a security measure to help prevent the MITM cert setup demonstrated here.
- maqr 11y ago
  For if that happens, or just for general convenience: https://github.com/iSECPartners/ios-ssl-kill-switch https://github.com/iSECPartners/ios-ssl-kill-switch
  - michaelbuckbee 11y ago
    Interesting! So in that case pinning would only help against upstream attacks in actual traffic - but would still allow for reverse engineering?
    - maqr 11y ago
      Yeah, as long as you have control of the device. That hack only works if you have root, which means you have to be jailbroken, and Apple is always trying to stop that. I keep a jailbroken device around specifically for disabling all SSL for debugging and dumping app binaries/assets. I wish they'd just let me buy the thing rooted like Google does.
      - userbinator 11y ago
        As long as you have control of the device, you can force it to do what you want by patching the code.
- wingerlang 11y ago
  He is also using a jailbroken device, which means he could see the built NSURL request and whatnot anyway.
dandruffhead 11y ago
Are there cyript like alternative for Android?
- daemonize 11y ago
  Check out Frida (iOS and Android) http://www.frida.re/ http://www.frida.re/
brooklyndude 11y ago
This is actually a pretty cool talk. We're kind of lulled into thinking our Apps are super secure, he seems to take them apart fairly easy, SSH seems simple to ignore.

171 points by timanglade 11y ago

_krug 11y ago

Video is not working... Video is hosted with 'wistia' and the ID is 52endf5e4h, can someone stitch together a working URL? I'm on mobile

kristofferR 11y ago
https://embed-ssl.wistia.com/deliveries/6504b8003517d6b2fabdee02312ebf33703e0bd9/file.mp4 https://embed-ssl.wistia.com/deliveries/6504b8003517d6b2fabd...
ckurose 11y ago
Worked fine for me on mobile (chrome on iOS)... What browser are you using?

deleted 11y ago

[deleted]

deleted 11y ago

[deleted]

jonesb6 11y ago

Great video, worth watching even on mobile IMO.

cellularmitosis 11y ago

Terminal addicts will enjoy the ncurses-based mitmproxy as an alternative to Charles.

scintill76 11y ago
Or maybe cheapskates, since technically you're supposed to buy Charles after a 30-day trial (which didn't attempt to enforce itself in my experience.) I like Fiddler2 on Windows, and I almost had it working well on Wine/Linux, but had some issues with SSL. I should try mitmproxy for the SSL and Fiddler for the UI, but lately I haven't needed a proxy.
maqr 11y ago
I just made the switch from Charles to mitmproxy. The only issue I've found with it so far is that it seems really slow in returning responses. I'm not doing anything crazy with it either, but Charles was getting content to the device way faster.

michaelbuckbee 11y ago

I keep hearing rumors that Apple and Google are going to require that app developers start pinning SSL certs as a security measure to help prevent the MITM cert setup demonstrated here.

maqr 11y ago
For if that happens, or just for general convenience: https://github.com/iSECPartners/ios-ssl-kill-switch https://github.com/iSECPartners/ios-ssl-kill-switch
- michaelbuckbee 11y ago
  Interesting! So in that case pinning would only help against upstream attacks in actual traffic - but would still allow for reverse engineering?
  - maqr 11y ago
    Yeah, as long as you have control of the device. That hack only works if you have root, which means you have to be jailbroken, and Apple is always trying to stop that. I keep a jailbroken device around specifically for disabling all SSL for debugging and dumping app binaries/assets. I wish they'd just let me buy the thing rooted like Google does.
    - userbinator 11y ago
      As long as you have control of the device, you can force it to do what you want by patching the code.
wingerlang 11y ago
He is also using a jailbroken device, which means he could see the built NSURL request and whatnot anyway.

dandruffhead 11y ago

Are there cyript like alternative for Android?

daemonize 11y ago
Check out Frida (iOS and Android) http://www.frida.re/ http://www.frida.re/

brooklyndude 11y ago

This is actually a pretty cool talk. We're kind of lulled into thinking our Apps are super secure, he seems to take them apart fairly easy, SSH seems simple to ignore.