5 ms·

Can't say much about the security, but I suspect it's working by pretending to be a VPN provider and then proxying the traffic. It's then able to install a CA

Can't say much about the security, but I suspect it's working by pretending to be a VPN provider and then proxying the traffic. It's then able to install a CA root to generate any certs it needs to MITM traffic. Cert pinning will prevent this from working, but that's the only thing that will.

yodon 9y ago
Supposed sandboxing against malicious apps is precisely why I run iOS rather than Android. I get that Charles isn’t malicious, but what’s keeping any random free game app from doing the same thing? (Again, intended as a real question not a rhetorical one)
- deleted 9y ago
  [deleted]
- cbrevik 9y ago
  I’d guess App Store reviews stops that.
- gdavisson 9y ago
  Setting up Charles requires two explicit authorization steps (each requiring passcode/fingerprint/face verification): First, network interception requires adding a VPN config (the dialog warns that "All network activity on this iPhone may be filtered or monitored when using VPN"). Second, SSL MITM requires installing and trusting a root CA certificate (the relevant prompts in iOS are less clear -- they say that the cert will not be trusted until you enable it, but don't explain the implications if you do enable it).
- tinus_hn 9y ago
  The documentation states you have to follow the instructions to install the certificate manually which is what I would expect. You can also click a link to a certificate on a webpage and install it manually on iOS.
- tzahola 9y ago
  1. You have to turn on VPN in the system settings. 2. You have to trust the Charlesproxy root certificate; again, in the system settings.
  - eddieroger 9y ago
    1a. This requires your passcode, and any time a system is asking for your permission to do something is worth questioning. Even my least technosavvy friends and family have learned that if something is asking for your password and you don't know why, abort.
- mavhc 9y ago
  How is that different from Android?
- mihaela 9y ago
  "what’s keeping any random free game app from doing the same" It's not that simple, as author stated, it was some of the most challenging code he ever wrote. Charles desktop app is well respected in the developer community. There is no reason that the iOS app will be treated any differently.
ce4 9y ago
Client certificates will prevent it too.
zuck9 9y ago
How do you intercept traffic from apps that use cert pinning? Is the only way to patch the app binary and reinstall the patched binary using a dev certificate? How exactly does one go about patching the binary – is there a tutorial somewhere?
- ktta 9y ago
  >Is the only way to patch the app binary and reinstall the patched binary using a dev certificate? Yes >How exactly does one go about patching the binary – is there a tutorial somewhere? https://www.guardsquare.com/en/blog/iOS-SSL-certificate-pinning-bypassing https://www.guardsquare.com/en/blog/iOS-SSL-certificate-pinn...
- t1o5 9y ago
  Won't an app worth its salt use certificate pinning to prevent this mitm ? In other words - Can I use Charles to sniff FB or watsapp traffic ? I do not use both services, but interested in analyzing their traffic.
  - deleted 9y ago
    [deleted]
  - robterrell 9y ago
    You'll see the attempted request (the fact that there was a request to a named server) but none of the request details, except the encrypted stream. There are guides you can google for cracking apps and replacing the certs they compare against. IIRC they all require a jailbroken device.
huhtenberg 9y ago
> It's then able to install a CA root Under what conditions does iOS allow an app to do this?
- hrrsn 9y ago
  Apps can do this by presenting a configuration profile to the user. This requires entering the passcode and a few steps - it’s not something they can do silently.
  - runeb 9y ago
    Also, after installing a certificate the user needs to explicitly go into Settings sub menus and toggle trust for that certificate.
220V_USKettle 9y ago
Do iOS apps not require cert pinning by default for their respective APIs/whitelisted https domains?
- tzahola 9y ago
  Whitelisted domains? What? Never heard of that in iOS.
  - paws 9y ago
    Apple introduced App Transport Security[1] with iOS 9. The setting is configured in your app's Info.plist[2]. [1] https://developer.apple.com/library/content/releasenotes/General/WhatsNewIniOS/Articles/iOS9.html https://developer.apple.com/library/content/releasenotes/Gen... [2] https://stackoverflow.com/a/48089038/2044952 https://stackoverflow.com/a/48089038/2044952
    - tzahola 9y ago
      Yep. App Transport Security mandates that you have to explicitly whitelist the domains [0] which you want to access via plain http. This however, has nothing to do with certificate pinning, which the OP was mentioning. [0] Of course you can use the blanket NSAllowsArbitraryLoads to allow plain HTTP everywhere.

yodon 9y ago

Supposed sandboxing against malicious apps is precisely why I run iOS rather than Android. I get that Charles isn’t malicious, but what’s keeping any random free game app from doing the same thing? (Again, intended as a real question not a rhetorical one)

deleted 9y ago
[deleted]
cbrevik 9y ago
I’d guess App Store reviews stops that.
gdavisson 9y ago
Setting up Charles requires two explicit authorization steps (each requiring passcode/fingerprint/face verification): First, network interception requires adding a VPN config (the dialog warns that "All network activity on this iPhone may be filtered or monitored when using VPN"). Second, SSL MITM requires installing and trusting a root CA certificate (the relevant prompts in iOS are less clear -- they say that the cert will not be trusted until you enable it, but don't explain the implications if you do enable it).
tinus_hn 9y ago
The documentation states you have to follow the instructions to install the certificate manually which is what I would expect. You can also click a link to a certificate on a webpage and install it manually on iOS.
tzahola 9y ago
1. You have to turn on VPN in the system settings. 2. You have to trust the Charlesproxy root certificate; again, in the system settings.
- eddieroger 9y ago
  1a. This requires your passcode, and any time a system is asking for your permission to do something is worth questioning. Even my least technosavvy friends and family have learned that if something is asking for your password and you don't know why, abort.
mavhc 9y ago
How is that different from Android?
mihaela 9y ago
"what’s keeping any random free game app from doing the same" It's not that simple, as author stated, it was some of the most challenging code he ever wrote. Charles desktop app is well respected in the developer community. There is no reason that the iOS app will be treated any differently.

ce4 9y ago

Client certificates will prevent it too.

zuck9 9y ago

How do you intercept traffic from apps that use cert pinning? Is the only way to patch the app binary and reinstall the patched binary using a dev certificate? How exactly does one go about patching the binary – is there a tutorial somewhere?

ktta 9y ago
>Is the only way to patch the app binary and reinstall the patched binary using a dev certificate? Yes >How exactly does one go about patching the binary – is there a tutorial somewhere? https://www.guardsquare.com/en/blog/iOS-SSL-certificate-pinning-bypassing https://www.guardsquare.com/en/blog/iOS-SSL-certificate-pinn...
t1o5 9y ago
Won't an app worth its salt use certificate pinning to prevent this mitm ? In other words - Can I use Charles to sniff FB or watsapp traffic ? I do not use both services, but interested in analyzing their traffic.
- deleted 9y ago
  [deleted]
- robterrell 9y ago
  You'll see the attempted request (the fact that there was a request to a named server) but none of the request details, except the encrypted stream. There are guides you can google for cracking apps and replacing the certs they compare against. IIRC they all require a jailbroken device.

huhtenberg 9y ago

> It's then able to install a CA root Under what conditions does iOS allow an app to do this?

hrrsn 9y ago
Apps can do this by presenting a configuration profile to the user. This requires entering the passcode and a few steps - it’s not something they can do silently.
- runeb 9y ago
  Also, after installing a certificate the user needs to explicitly go into Settings sub menus and toggle trust for that certificate.

220V_USKettle 9y ago

Do iOS apps not require cert pinning by default for their respective APIs/whitelisted https domains?

tzahola 9y ago
Whitelisted domains? What? Never heard of that in iOS.
- paws 9y ago
  Apple introduced App Transport Security[1] with iOS 9. The setting is configured in your app's Info.plist[2]. [1] https://developer.apple.com/library/content/releasenotes/General/WhatsNewIniOS/Articles/iOS9.html https://developer.apple.com/library/content/releasenotes/Gen... [2] https://stackoverflow.com/a/48089038/2044952 https://stackoverflow.com/a/48089038/2044952
  - tzahola 9y ago
    Yep. App Transport Security mandates that you have to explicitly whitelist the domains [0] which you want to access via plain http. This however, has nothing to do with certificate pinning, which the OP was mentioning. [0] Of course you can use the blanket NSAllowsArbitraryLoads to allow plain HTTP everywhere.