8 ms·
Reverse engineering and removing Pokémon GO’s certificate pinning
- ethanhunt_ 10y agoVery cool workaround in the article, but it feels like it's just another hole that is going to be closed off. It's impossible to balance because on the one hand we want these fortresses to protect us from prying eyes (see apple vs fbi), but manufacturers are also using these fortresses to keep out owners who just want to hack on their own things. I'm glad Apple is working to keep backdoors out of iOS, but I still prefer Android because I can get into it anyway I want, and do things like the OP without having to resort to backdooring my own device.
- Retric 10y agoI think 98% of people are really better off in a closed system (excluding piracy). The real issue IMO is getting developer access to any Android or iOS device should be a straightforward and free process.
- TeMPOraL 10y agoThey're not better off - that's a bit like saying people would be better off if hairdryers were DRMed by magic to heat up only hair. Those closed systems are significantly limiting the usefulness of computing devices. Hell, it's getting hard to call modern mobile platforms "computing devices" - they're becoming glorified TV screens / pretty interfaces to your credit card. Also, that remaining 2% has to come from somewhere. People learn to make next-gen tech by playing with and reverse-engineering today's tech.
- Retric 10y agoConsidering how many people download and install software that harms their PC, where tablets and phones are 'safe' it's complicated. People just don't ask others to come and fix my tablet which really is a vast improvement.
- zeveb 10y ago> It's impossible to balance because on the one hand we want these fortresses to protect us from prying eyes (see apple vs fbi), but manufacturers are also using these fortresses to keep out owners who just want to hack on their own things. I think it's very easy to balance: it's my fortress, because I bought it; I should therefor be allowed and enabled to make it do anything I like. The recent changes which Google have announced — which mean that apps will no longer respect the keys I have installed on my devices — are a move in exactly the wrong direction.
- jluxenberg 10y agoHow do you prove to the device that you are the one who bought it? You don't want e.g. an FBI agent to be able to root your device.
- zeveb 10y ago> How do you prove to the device that you are the one who bought it? An arbitrarily-complex passphrase of my choosing plus a fingerprint seem reasonable.
- mavhc 10y agoPlus a set of long and complex commands to type to stop normal people being tricked into enabling it
- zeveb 10y agoY'know, I honestly don't care all that much if normal people can screw up: learning not to screw up should be part of the public school education all our taxes pay for. We trust normal people not to stab themselves in the eye, not to shoot themselves through the head, not to crash their cars into others: we should trust them not to do stupid stuff on their computing devices. And when they do, we should hold them liable for any damage their actions have caused to others, just as we do with all those other tools. Yes, I think liability for allowing one's computer to become part of a botnet is a Good Idea™. Car crashes aren't accidents, and allowing one's computer to become infected isn't accidental either.
- sangnoir 10y ago> but manufacturers are also using these fortresses to keep out owners who just want to hack on their own things. I'll play the devils advocate: 1. From manufacturers perspective, it is very difficult to differentiate if the modification are being intentionally done by the owner of the device, or if the owner is being attacked by a 3rd party (e.g. via malware or JTAG) 2. Ownership ends with the device and the app - you cannot 'own' a service that Google/Niantic/Apple/Steam are providing. They can dictate the terms for providing that service and for an online game like Pokemon, not having access to the service makes the ownership the app and the device pointless.
- paste0x78 10y agoSeems to be down, Google webcache version: http://webcache.googleusercontent.com/search?q=cache:https://eaton-works.com/2016/07/31/reverse-engineering-and-removing-pokemon-gos-certificate-pinning/ http://webcache.googleusercontent.com/search?q=cache:https:/...
- ParadoxOryx 10y agoThanks! Here's a copy on archive.is as well: http://archive.is/gjgYx http://archive.is/gjgYx
- kuschku 10y agoAnd here the archive.org version for the people in the countries where archive.is is unavailable[1]: https://web.archive.org/web/20160801021520/https://eaton-works.com/2016/07/31/reverse-engineering-and-removing-pokemon-gos-certificate-pinning/ https://web.archive.org/web/20160801021520/https://eaton-wor... ________________________ [1] The author of archive.is blocked entire countries in a fit of rage
- EatonZ 10y agoThings are stabilizing, was not expecting the article to get this many hits!
- dpflan 10y agoRelated: https://news.ycombinator.com/item?id=12204742 https://news.ycombinator.com/item?id=12204742
- thewarpaint 10y agoWhat's the added value of using imgur's embed code rather than a good ol' <img>? Is this a trend? I would understand it for albums, but why would you do it for individual images? </rant>
- nomel 10y agoDirect links are against imgurs TOS (http://imgur.com/tos http://imgur.com/tos): "Also, don't use Imgur to host image libraries you link to from elsewhere, content for your website, advertising, avatars, or anything else that turns us into your content delivery network."
- slig 10y agoFunny how not long ago that was one of their selling point.
- bpodgursky 10y agoYeah, but then massive gifs became a thing.
- mavhc 10y agobut then serving animated gifs as mp4 became a thing. Of course then using it as a video host became a thing
- skeletonjelly 10y agoSeems as though they don't want to be a CDN, not that they don't want direct linking from forum users? Anyway I went for a dig through Alan's old reddit posts because I thought I recalled him saying he's fine with direct links https://www.reddit.com/r/IAmA/comments/y81ju/i_created_imgur_ama/c6smgqm?context=3 https://www.reddit.com/r/IAmA/comments/y81ju/i_created_imgur... > Nothing has changed in regards to direct linking. I'm not sure what you're seeing exactly, but we'll always allow you to direct link to any image you want. https://www.reddit.com/r/IAmA/comments/y81ju/i_created_imgur_ama/c5t921v?context=3 https://www.reddit.com/r/IAmA/comments/y81ju/i_created_imgur... > Yes, but you can also look at it as a marketing budget. When people share links, direct or not, the other person now knows about Imgur. https://www.reddit.com/r/pics/comments/ea4vi/for_the_beginner_imgur_user/c16jtkp?context=3 https://www.reddit.com/r/pics/comments/ea4vi/for_the_beginne... > People linking to the page rather than the image is what keeps imgur going. If everyone linked to the direct image then imgur would have no source of revenue. However, I want people to use the service however they want, and by no means would I ever force anyone to do it one certain way. So, I like it when people link to the page because that's how imgur makes money, but you don't have to do it if you don't want to. I'm just happy that you like the service.
- dozy 10y agoPatching an APK like this would break parts of the app, specifically the parts that are arguably the most crucial to be followed by pinned API calls. For example, in-app purchases via Google Play that validate the app's signing would all fail. Similarly restoring any previous in app purchases would also fail. Finally, you wouldn't be able to install this APK without uninstalling the valid production APK first, again due to signature/signing mismatch.
- maxerickson 10y agoA normal user wouldn't do this, someone who cared more about examining the network traffic than in app purchases would do this.
- dozy 10y agoAgreed. I was commenting on this workaround's viability to be used by a bad actor attempting to compromise the game and other players of it.
- conradev 10y agoWould patching it using Cydia Substrate keep the app's signature intact?
- jor-el 10y agoCydia performs dynamic hooking, and patches the function in the runtime. In theory app's signature should be intact (I have never come across this scenario in practice, so might be wrong). Generally, application implement additional checks for function hooking and dynamic library injections to prevent such attacks.
- kamikizzle 10y agois this cert in the update the reason apps like pokevision stopped working?
- beckler 10y agoI don't know for sure, but I'm going to say 'not entirely'. Certificate pinning would prevent you from sniffing the requests, and if they made API changes, you would be unable to analyze them. So I think the reason Pokevision stopped working is because they may have made API changes, but they've been unable to see what the changes were.
- 9999 10y agoPokevision stopped working because they banned the whole ec2 IP range.
- spdustin 10y agoI believe you, so please don't take this is a challenge. It's pure curiosity that prompts me to ask: Do you have a source for more info on this IP range ban?
- synackrst 10y agoOne source is a GitHub issue for one of the popular open source Pokémon Maps -- https://github.com/AHAAAAAAA/PokemonGo-Map/issues/2777 https://github.com/AHAAAAAAA/PokemonGo-Map/issues/2777 . AWS/Heroku/Azure/DigitalOcean (mostly) seem to be banned.
- seanalltogether 10y agoThe pokemongo dev forums on reddit have been compiling a list of known hosts that will result in a 403 response code when an api call is requested. https://www.reddit.com/r/pokemongodev/comments/4vhygk/vps_providers_banned_from_accessing_apis/ https://www.reddit.com/r/pokemongodev/comments/4vhygk/vps_pr...
- 10y ago
- bitmapbrother 10y agoAs mentioned in the comments, this doesn't work when you try to sign in via Google because it checks the signature of the app. The PTC signon doesn't do this so it's currently allowed, but I'm sure Niantic will patch it soon.
- baby 10y agoThis seems like overly complicated. He could have made the public key extremely small by just placing 0x00s in it so that he could crack it. Easy patching.
- ajnin 10y agoHe patches two instructions, or 4 bytes, removing the check entirely. No need to "crack" anything. Seems like a pretty simple solution to me. You'll also notice that the code checks for the certificate length so I'm not sure replacing it with zeroes would have worked.
- baby 10y agothe key is still the same length, it just has a lot of zeroes.
- alfon 10y agoIn iOS though, SSLKillSwitch v2 does the job well.
- dagwaging 10y agoit could also be done pretty trivially using an xposed module, such as: http://repo.xposed.info/module/mobi.acpm.sslunpinning http://repo.xposed.info/module/mobi.acpm.sslunpinning i haven't personally tried this route yet though
- mkagenius 10y agoIt needs rooted android phone. OP has done it without even needing a rooted device.
- jor-el 10y agoXposed module patching only works when SSLPinning is performed in the Java code of the application, as Xposed provides a mechanism for intercepting Java method calls only. Unlike in this case, the code is in C/C++ layer, hence can't be used.
- chinpokomon 10y agoPretty much how I started cracking game copy protections in the late 80's/early 90's. I already owned the games I was cracking, it just became more interesting to me how these protections were implemented and how I'd defeat them. Sometimes I think that was more fun than the game itself. I just didn't want to have to look up pages in manuals or read maroon colored paper with dark blue ink. I didn't have the luxury of Ida Pro back then, but I did find a disassembler. Using that I'd read through the game code until I found the conditional jumps and then patched the original file with 0xE8 (JEZ?), 0xEB (JMP?), or 0xCD 0x90 (NOP?). At one time I used to be able to recognize just the Opcodes in hex, so I might have those wrong today. When I started working at Egghead, I was granted time by my manger to crack games for our demo station, so we wouldn't have to jump through hoops on the sales floor. For various professional reasons I've had the pleasure of bypassing my company's own protections. Most recently I used Smali/Baksmali to demonstrate how our company's Android beta timebomb was pretty easy to circumvent. Once a hacker, always a hacker. I have no doubt that this low level tinkering was why I got into computers in the first place and why they still hold my fascination.