4 ms·

What if I want to use my router to block telemetry domains? Or other malware sites? It’s looking like the only way forward is running my own CA to mitm all encr

What if I want to use my router to block telemetry domains? Or other malware sites? It’s looking like the only way forward is running my own CA to mitm all encrypted traffic.

JoshTriplett 9y ago
> It’s looking like the only way forward is running my own CA to mitm all encrypted traffic. Correct. Middleboxes should be presumed hostile; if you control the endpoints you can install a MITM CA, but it's safer to put what you want directly on the endpoint.
aoeusnth1 9y ago
That seems superior anyway - you could keep blocking domains even when you're on the go.
- kuschku 9y ago
  Can I? On Android, apps now can decide if they want to accept user-installed CAs, or not. So if an app is hostile (say, all the Google apps), then I have no way to intercept their traffic anymore.
  - pas 9y ago
    You can decide to install the app or not. And you can put your CA into the system CA store if you have root. (You can make an Android image, so technically the requirement is unlocked - unlockable - bootloader.)
    - kuschku 9y ago
      Unlocking the bootloader makes the device permanently fail the strictest SafetyNet category. Apps can and will refuse to run in that situation. Modifying /system will make every SafetyNet check fail, as result Netflix, Snapchat, Google Play Movies, and most banking apps will refuse to run. I can decide to install the app or not? How do I go about replacing Google's system apps with my own, without preventing above mentioned apps from running? I can't. And I can't buy reasonable devices withou Google Android, due to the non-compete clause in the OEM contracts.
      - pas 9y ago
        Then don't buy it. Or support efforts like Librem (and LineageOS and Magisk). http://www.androidpolice.com/2017/07/16/safetynet-can-detect-magisk-fix-works/ http://www.androidpolice.com/2017/07/16/safetynet-can-detect... You can walk into your bank and access the services. Or call them. Or use their browser based service, right? Google and a lot of developers made the choice to restrict user freedom for more security. I don't agree with it, but it's what it is. A trade off. Of course, you can sign your own images and put the CA into the recovery DB and relock the bootloader on reasonable devices. ( https://mjg59.dreamwidth.org/31765.html https://mjg59.dreamwidth.org/31765.html ) Or at least you used to be able to.
  - zb3 9y ago
    You can patch the app using apktool/smali or even use JTM[0], but I prefer just blocking their traffic using iptables. [0] - https://github.com/Fuzion24/JustTrustMe https://github.com/Fuzion24/JustTrustMe
    - kuschku 9y ago
      That also invalidates some SafetyNet verification, unless I abuse the new dex/apk signature verification vulnerability. Either the user controls the program, or the program controls the user.
- vbezhenar 9y ago
  Easier approach is to use your own DNS server and blacklist those domains.
zb3 9y ago
Which will fail if apps check public keys manually, and is also not very efficient. I think we'll need to patch applications directly, but the good news is that since many people will need this, those patches will probably be developed.
slrz 9y ago
What? You control the endpoint. No need to MITM when you can just make your browser do what you want.
- fiddlerwoaroof 9y ago
  Then I only solve the issue on my browser: what about my phone, and all the random other programs that phone home?

What if I want to use my router to block telemetry domains? Or other malware sites? It’s looking like the only way forward is running my own CA to mitm all encrypted traffic.

JoshTriplett 9y ago

> It’s looking like the only way forward is running my own CA to mitm all encrypted traffic. Correct. Middleboxes should be presumed hostile; if you control the endpoints you can install a MITM CA, but it's safer to put what you want directly on the endpoint.

aoeusnth1 9y ago

That seems superior anyway - you could keep blocking domains even when you're on the go.

kuschku 9y ago
Can I? On Android, apps now can decide if they want to accept user-installed CAs, or not. So if an app is hostile (say, all the Google apps), then I have no way to intercept their traffic anymore.
- pas 9y ago
  You can decide to install the app or not. And you can put your CA into the system CA store if you have root. (You can make an Android image, so technically the requirement is unlocked - unlockable - bootloader.)
  - kuschku 9y ago
    Unlocking the bootloader makes the device permanently fail the strictest SafetyNet category. Apps can and will refuse to run in that situation. Modifying /system will make every SafetyNet check fail, as result Netflix, Snapchat, Google Play Movies, and most banking apps will refuse to run. I can decide to install the app or not? How do I go about replacing Google's system apps with my own, without preventing above mentioned apps from running? I can't. And I can't buy reasonable devices withou Google Android, due to the non-compete clause in the OEM contracts.
    - pas 9y ago
      Then don't buy it. Or support efforts like Librem (and LineageOS and Magisk). http://www.androidpolice.com/2017/07/16/safetynet-can-detect-magisk-fix-works/ http://www.androidpolice.com/2017/07/16/safetynet-can-detect... You can walk into your bank and access the services. Or call them. Or use their browser based service, right? Google and a lot of developers made the choice to restrict user freedom for more security. I don't agree with it, but it's what it is. A trade off. Of course, you can sign your own images and put the CA into the recovery DB and relock the bootloader on reasonable devices. ( https://mjg59.dreamwidth.org/31765.html https://mjg59.dreamwidth.org/31765.html ) Or at least you used to be able to.
- zb3 9y ago
  You can patch the app using apktool/smali or even use JTM[0], but I prefer just blocking their traffic using iptables. [0] - https://github.com/Fuzion24/JustTrustMe https://github.com/Fuzion24/JustTrustMe
  - kuschku 9y ago
    That also invalidates some SafetyNet verification, unless I abuse the new dex/apk signature verification vulnerability. Either the user controls the program, or the program controls the user.
vbezhenar 9y ago
Easier approach is to use your own DNS server and blacklist those domains.

zb3 9y ago

Which will fail if apps check public keys manually, and is also not very efficient. I think we'll need to patch applications directly, but the good news is that since many people will need this, those patches will probably be developed.

slrz 9y ago

What? You control the endpoint. No need to MITM when you can just make your browser do what you want.

fiddlerwoaroof 9y ago
Then I only solve the issue on my browser: what about my phone, and all the random other programs that phone home?