6 ms·

Some of the highlights from Will Strafach, who did the actual app research for TechCrunch: #1 "they didn't even bother to change the function names, the select

Some of the highlights from Will Strafach, who did the actual app research for TechCrunch: #1 "they didn't even bother to change the function names, the selector names, or even the "ONV" class prefix. it's literally all just Onavo code with a different UI." #2 "the Root Certificate they have users install so that they can access any TLS-encrypted traffic they'd like." My editorializing - I have been suspicious of Facebook getting the "submarine" treatment (1) but the insane scuminess of #1 above, which essentially is a big fuck you to Apple, pretty well supports the recent view that FB will essentially break any rule that serves to further their own ends. via https://twitter.com/chronic/status/1090394419902197761 https://twitter.com/chronic/status/1090394419902197761 (1) http://www.paulgraham.com/submarine.html http://www.paulgraham.com/submarine.html

varenc 8y ago
Side note: This wouldn't get around cert-pinning? Even if a new trusted CA is installed on the system, an app implementing cert pinning still wouldn't trust this new CA. Seems that could be a wise move for Facebook's rivals that want to limit snooping. Edit: on 2nd thought even if Facebook can't decrypt a particular app's traffic, just knowing how many requests it makes, how large they are, and how often, could still provide some useful insights into an app's usage.
- saagarjha 8y ago
  AFAIK, yes. You would have to modify the application itself to disable certificate pinning.
  - gcbw2 8y ago
    you have root. Might be inconvenient but hardly impossible to modify files to drop your own pinned cert in other binaries.
    - saagarjha 8y ago
      As I've mentioned elsewhere in other threads, this app doesn't actually obtain root access (that is, it's not a jailbreak); the article/title is confusing a "root certificate" with "root access".
- Gregordinary 8y ago
  If the app is hard coded it shouldn't trust another cert. Note though that browsers, like Chrome, ignore cert pinning if the cert chains up to a locally trusted CA. So the answer is more "It Depends". > Chrome does not perform pin validation when the certificate chain chains up to a private trust anchor. A key result of this policy is that private trust anchors can be used to proxy (or MITM) connections, even to pinned sites. “Data loss prevention” appliances, firewalls, content filters, and malware can use this feature to defeat the protections of key pinning. http://www.chromium.org/Home/chromium-security/security-faq#TOC-How-does-key-pinning-interact-with-local-proxies-and-filters- http://www.chromium.org/Home/chromium-security/security-faq#... EDIT: Spaced on the fact this is a phone app. While Chrome on Windows ignores certificate pins, I'm unsure if this also applies to Android / iOS root stores as well.
  - dzhiurgis 8y ago
    So what DOES pinning protect against? Certs generated by state actors with access to CA’s?
    - frankchn 8y ago
      That, and (more commonly) CAs mis-issuing certificates to malicious actors due to bugs or weak internal controls.
    - jevinskie 8y ago
      You can enforce certificate pinning in your own native app. You can even go as far as not trusting the hookable (on a JBen device) system libraries and link in your own OpenSSL or something similar.
  - lol768 8y ago
    I was under the impression Chrome was dropping HPKP support (it was deprecated in 2017), so I imagine this would be across all products - desktop and mobile.
    - Leace 8y ago
- judge2020 8y ago
  I know Uber and a few other apps certificate pin, since running a mitm proxy myself made Uber non-functional.
  - QualityReboot 8y ago
    You can fix that with https://www.frida.re/ https://www.frida.re/
    - lozaning 8y ago
      Is it possible to set this up to work like charles proxy?
      - QualityReboot 8y ago
        Yeah, the idea is to remove pinning with frida and then your proxy will see all the traffic. There's some sample scripts here, and if you google around you'll find one for iOS: https://codeshare.frida.re/ https://codeshare.frida.re/ Jailbreak required, of course.
    - saagarjha 8y ago
      Not without access to a jailbroken device.
- willstrafach 8y ago
  You are correct! Many apps do not do pinning currently.
Avery3R 8y ago
On most devices the cert the VPN server uses has to chain up to a trusted root ca.
ericlnu 8y ago
Duh ;). FB isn't the only one... So many do this, your head would spin twice and it wouldn't even hurt. People need to see the bigger picture. FB is just one example.
- mathnmusic 8y ago
  > So many do this Point out a few? This needs to be common knowledge.
- princekolt 8y ago
  [citation needed]
nebulous1 8y ago
The article didn't actually mention whether Facebook were MITMing TLS connections by default or whether they'd observed them doing it at all.
dathinab 8y ago
Hm, - installing root certificate to access encrypted data (potentially of websites? including banking websites?) - means bypassing security mechanism put in place to prevent people to access data send to a server (from a browser/app) - means potentially bypassing DRM, too => isn't that illegal even if the user agrees to it? (at last in the US where some especially DRM related laws are strange)
- Retr0spectrum 8y ago
  How would this bypass DRM?
  - Wowfunhappy 8y ago
    I think the parent is implying that HTTPS encryption is a form of DRM. It's a reasonable question because AFAIK, the DMCA doesn't specifically call out DRM but rather any security/protection measures, so I can see how HTTPS would fall into that. (However, upthread comments indicate that using certificates to see HTTPS traffic is a fairly common practice in enterprise setups)
- Ninn 8y ago
  No that is absurd, this is standard practice for almost all enterprise setups, as a central component in the deep packet inspection solutions used in network security. So the chance of it being illegal as the user has agreed to participate is absurd. The only thing that would make it so would be to lie about the functionality and intrusiveness.
  - danesparza 8y ago
    Remember that in the case of the Facebook VPN, they were asking teens to install it -- which means the teens involved (according to US law) are a protected class: under adult age. Under age folks can't legally agree to participate in anything.
  - salawat 8y ago
    Keep in mind, just because everyone does it doesn't mean squat for is it legal or not. It means it hasn't been tested in the legal system, such that a judgement has been passed regarding legality. If somehow, the practice were found to be a key part of circumventing some large industry's means of controlling something, it could realistically end up becoming illegal once subject to legal scrutiny.
me551ah 8y ago
Installing a root certificate is a major breach of privacy. This is what Fiddler does on windows when you need development access to a machine and want to view data being transferred between all websites including https. By using a VPN they forced all traffic to go through their servers, and with the root certificate, they are able to monitor and gather data from every single app and website users visit/use. Which would include medical apps, chat apps, Maps/gps apps and even core operating system apps. So for users using Facebook's VPN they are effectively able to mine data which actually belongs to other apps/websites.
- diamondo25 8y ago
  Lets not forget they can modify the content as well!
  - zjs 8y ago
    Imagine the malicious things someone could do with this level of access. And none of the usual mechanisms to, say, detect widespread compromise of a Certificate Authority would apply here. They could drain your bank account, hiding the transactions and adjusting the balance whenever you viewed the mobile banking website or used your mobile banking app and adjusting any emailed statements. They could send messages to your friends and family from your account asking them to send money to you in a certain way or donate money to a "charity", hiding the entire conversation from your view. They could make some services you use slower or less reliable in subtle ways, to steer you towards the ones they want you to use— the ones that are easier for them to manipulate the traffic to/from. They could make you think you're going insane, in any one of a variety of ways. They could gather all of your private information, and then lock you out of your entire digital life all at once. Two-factor authentication wouldn't protect you; they could present you with a fake "re-confirm your settings" process to collect the information necessary to disable or replace the settings. (If you pay your rent using your phone, they could lock you out of your physical life too; they could prevent the payment from going through, show you a confirmation, and suppress notifications of unpaid rent and e-mails from your landlord.) They could control which news you see, slowly shifting your views on things like privacy and security. If you get suspicious about any of this, they could plant false information in your search results.

varenc 8y ago

Side note: This wouldn't get around cert-pinning? Even if a new trusted CA is installed on the system, an app implementing cert pinning still wouldn't trust this new CA. Seems that could be a wise move for Facebook's rivals that want to limit snooping. Edit: on 2nd thought even if Facebook can't decrypt a particular app's traffic, just knowing how many requests it makes, how large they are, and how often, could still provide some useful insights into an app's usage.

saagarjha 8y ago
AFAIK, yes. You would have to modify the application itself to disable certificate pinning.
- gcbw2 8y ago
  you have root. Might be inconvenient but hardly impossible to modify files to drop your own pinned cert in other binaries.
  - saagarjha 8y ago
    As I've mentioned elsewhere in other threads, this app doesn't actually obtain root access (that is, it's not a jailbreak); the article/title is confusing a "root certificate" with "root access".
Gregordinary 8y ago
If the app is hard coded it shouldn't trust another cert. Note though that browsers, like Chrome, ignore cert pinning if the cert chains up to a locally trusted CA. So the answer is more "It Depends". > Chrome does not perform pin validation when the certificate chain chains up to a private trust anchor. A key result of this policy is that private trust anchors can be used to proxy (or MITM) connections, even to pinned sites. “Data loss prevention” appliances, firewalls, content filters, and malware can use this feature to defeat the protections of key pinning. http://www.chromium.org/Home/chromium-security/security-faq#TOC-How-does-key-pinning-interact-with-local-proxies-and-filters- http://www.chromium.org/Home/chromium-security/security-faq#... EDIT: Spaced on the fact this is a phone app. While Chrome on Windows ignores certificate pins, I'm unsure if this also applies to Android / iOS root stores as well.
- dzhiurgis 8y ago
  So what DOES pinning protect against? Certs generated by state actors with access to CA’s?
  - frankchn 8y ago
    That, and (more commonly) CAs mis-issuing certificates to malicious actors due to bugs or weak internal controls.
  - jevinskie 8y ago
    You can enforce certificate pinning in your own native app. You can even go as far as not trusting the hookable (on a JBen device) system libraries and link in your own OpenSSL or something similar.
- lol768 8y ago
  I was under the impression Chrome was dropping HPKP support (it was deprecated in 2017), so I imagine this would be across all products - desktop and mobile.
  - Leace 8y ago
judge2020 8y ago
I know Uber and a few other apps certificate pin, since running a mitm proxy myself made Uber non-functional.
- QualityReboot 8y ago
  You can fix that with https://www.frida.re/ https://www.frida.re/
  - lozaning 8y ago
    Is it possible to set this up to work like charles proxy?
    - QualityReboot 8y ago
      Yeah, the idea is to remove pinning with frida and then your proxy will see all the traffic. There's some sample scripts here, and if you google around you'll find one for iOS: https://codeshare.frida.re/ https://codeshare.frida.re/ Jailbreak required, of course.
  - saagarjha 8y ago
    Not without access to a jailbroken device.
willstrafach 8y ago
You are correct! Many apps do not do pinning currently.

Avery3R 8y ago

On most devices the cert the VPN server uses has to chain up to a trusted root ca.

ericlnu 8y ago

Duh ;). FB isn't the only one... So many do this, your head would spin twice and it wouldn't even hurt. People need to see the bigger picture. FB is just one example.

mathnmusic 8y ago
> So many do this Point out a few? This needs to be common knowledge.
princekolt 8y ago
[citation needed]

nebulous1 8y ago

The article didn't actually mention whether Facebook were MITMing TLS connections by default or whether they'd observed them doing it at all.

dathinab 8y ago

Hm, - installing root certificate to access encrypted data (potentially of websites? including banking websites?) - means bypassing security mechanism put in place to prevent people to access data send to a server (from a browser/app) - means potentially bypassing DRM, too => isn't that illegal even if the user agrees to it? (at last in the US where some especially DRM related laws are strange)

Retr0spectrum 8y ago
How would this bypass DRM?
- Wowfunhappy 8y ago
  I think the parent is implying that HTTPS encryption is a form of DRM. It's a reasonable question because AFAIK, the DMCA doesn't specifically call out DRM but rather any security/protection measures, so I can see how HTTPS would fall into that. (However, upthread comments indicate that using certificates to see HTTPS traffic is a fairly common practice in enterprise setups)
Ninn 8y ago
No that is absurd, this is standard practice for almost all enterprise setups, as a central component in the deep packet inspection solutions used in network security. So the chance of it being illegal as the user has agreed to participate is absurd. The only thing that would make it so would be to lie about the functionality and intrusiveness.
- danesparza 8y ago
  Remember that in the case of the Facebook VPN, they were asking teens to install it -- which means the teens involved (according to US law) are a protected class: under adult age. Under age folks can't legally agree to participate in anything.
- salawat 8y ago
  Keep in mind, just because everyone does it doesn't mean squat for is it legal or not. It means it hasn't been tested in the legal system, such that a judgement has been passed regarding legality. If somehow, the practice were found to be a key part of circumventing some large industry's means of controlling something, it could realistically end up becoming illegal once subject to legal scrutiny.

me551ah 8y ago

Installing a root certificate is a major breach of privacy. This is what Fiddler does on windows when you need development access to a machine and want to view data being transferred between all websites including https. By using a VPN they forced all traffic to go through their servers, and with the root certificate, they are able to monitor and gather data from every single app and website users visit/use. Which would include medical apps, chat apps, Maps/gps apps and even core operating system apps. So for users using Facebook's VPN they are effectively able to mine data which actually belongs to other apps/websites.

diamondo25 8y ago
Lets not forget they can modify the content as well!
- zjs 8y ago
  Imagine the malicious things someone could do with this level of access. And none of the usual mechanisms to, say, detect widespread compromise of a Certificate Authority would apply here. They could drain your bank account, hiding the transactions and adjusting the balance whenever you viewed the mobile banking website or used your mobile banking app and adjusting any emailed statements. They could send messages to your friends and family from your account asking them to send money to you in a certain way or donate money to a "charity", hiding the entire conversation from your view. They could make some services you use slower or less reliable in subtle ways, to steer you towards the ones they want you to use— the ones that are easier for them to manipulate the traffic to/from. They could make you think you're going insane, in any one of a variety of ways. They could gather all of your private information, and then lock you out of your entire digital life all at once. Two-factor authentication wouldn't protect you; they could present you with a fake "re-confirm your settings" process to collect the information necessary to disable or replace the settings. (If you pay your rent using your phone, they could lock you out of your physical life too; they could prevent the payment from going through, show you a confirmation, and suppress notifications of unpaid rent and e-mails from your landlord.) They could control which news you see, slowly shifting your views on things like privacy and security. If you get suspicious about any of this, they could plant false information in your search results.