4 ms·

This doesn't appear to do any SSL interception unfortunately. This plus a Frida [1] script or two would be amazing.

• bigiain 6y ago
  SSL interception has become much harder recently. Android apps need to be specifically compiled to allow them to use mitm ssl certs, and more and more apps are using pinned certs anyway (mostly following some corp/gov "best practice" security checklist I suspect). I think their indicators of compromise (IoC) list is probably a pretty good alternative for their intended use case. I wouldn't want to be relying on this to protect me against state level actors, but I could easily see their IoC list being capable of detecting the sort of tools readily available to jilted ex boyfriends or abusive husbands.
  • voltagex_ 6y ago
    Yes, for the stated use case. For malware analysis or analysing apps to create interoperable solutions, probably the only solution is a rooted phone and something like Frida.
    • bigiain 6y ago
      Yeah. Malware analysts and API reverse engineers are probably quite comfortable with rooting phones and using Frida or equivalents already.
    • kunfuu 6y ago
      Slightly off-topic. I was thinking if people can enforce a model where users can choose to delegate encryption work to OS or some kind of network gateway, and inspection is allowed before encryption happens, this would be a clean and built-in solution for the inspection issue.