5 ms·
It sounds like they're doing at least some reverse engineering via the Xposed framework, which requires root. However you could probably get similar findings by
by Rebelgecko 7y ago
It sounds like they're doing at least some reverse engineering via the Xposed framework, which requires root. However you could probably get similar findings by just sniffing your own network traffic.
- ChadMoran 7y agoUnfortunately with modern iOS/Android you need a rooted device. Modern iOS/Android have something called SSL Pinning. Which means if you want to use a self-signed cert to Man in the Middle the HTTPS traffic it won't work. So you need to patch the network stack to allow this. I have a spare iPhone I keep rooted for this reason.
- raverbashing 7y agoDo all apps use cert pinning? I think it got popular some years ago but I remember some downsides existing (I know things like Google Apps and such use it, but I'm not sure about less popular ones)
- ChadMoran 7y agoI haven't run into an app I've reverse engineered that didn't have it.
- jsjohnst 7y agoThen you are sampling a very small or a very biased set of apps.
- watermelon0 7y agoAndroid apps don't trust user CA certificates by default (they only work with web browsers.) You have to explicitly enable this option in app manifest. Rooting the device enables you to put custom certificates in system store, and bypass this check.
- barbecue_sauce 7y agoI've done a few and always ran into cert pinning issues.
- dewey 7y agoIn my experience only a very small percentage of the apps where I look at the traffic using Charles Proxy have the certificates pinned. Usually it's the stock apps from Apple that are all cert pinned.
- jsjohnst 7y agoSame experience for me across a wide category of iOS and Android apps.
- feanaro 7y agoYou can actually get by without root by using Frida (https://frida.re/docs/android/ https://frida.re/docs/android/), at least on Android. By repackaging the APK to include frida-gadget (such as in this tutorial: https://koz.io/using-frida-on-android-without-root/ https://koz.io/using-frida-on-android-without-root/), you can get all of Frida's capabilities on that app without root. That said, it is more convenient to have a spare rooted phone.
- jsjohnst 7y ago> Modern iOS/Android have something called SSL Pinning. Yep, the mobile OSes have that option, but it’s not very commonly used. I fairly regularly snoop traffic on apps and it’s not super often that I’m blocked temporarily by cert pinning.
- ChadMoran 7y agoInteresting. The last 6 apps I've reverse engineered they all had pinning on.
- behnamoh 7y agoIMO it's fortunately tho!