3 ms·

btw how would they handle android apps etc which pins the certs?

MaxBarraclough 6y ago
I was wondering the same. Presumably Netflix would only work through the browser, not through the apps available for various platforms.
jeroenhd 6y ago
I've worked for a company that specializes in blocking certain websites for certain people (porn blocking stuff). The company used MitM-attacks with a custom TLS certificate, just like the Kazakh government uses. There's two ways to deal with certificate pinning. The first is to apply SNI sniffing (which will work until eSNI makes its way into more software) to determine that a certain domain is related to a certain, permissible service and bypass the decryption filter. This can be coupled with certificate validation to prevent domain fronting. The second method requires rooting the device and using a tool like Frida to automatically disable any validation checks. On Android and iOS there are special APIs to do certificate pinning but not all apps leverage them. Many apps will also work fine if you install the CA to the system partition instead of using the user store. App developers often don't know that certificate authorities are even a thing that can be managed by the user, let alone that the set can be extended, so most apps use the default setting, which has been to only trust system certificates. This was changed back during the release of Android 7, before that time all apps defaulted to trusting user-installed certificates. The third option, which any company or government can take to get off easily, is to blame the app for trying to break your righteous surveillance and to leave the apps broken. Netflix can be made to work any time, all they need to do is release a patch that disables certificate pinning, so if the government can get the public to blame the apps, they get off scot free. The first method works transparently to applications. The second requires physical access to the device and rooting the OS, which can be impossible. The third only works if the people you're surveilling take your side. I'd guess they pick option 1 or 3.
- p410n3 6y ago
  In security, certificate pinning is a good practice because it defends against, who guessed it, MITM.
  - jeroenhd 6y ago
    Obviously. Few apps (outside the very big ones) actually do it though, and with root access any attempt at cert pinning is trivially bypassed of course. Annoyingly, many telemetry providers seem to have implemented cert pinning because I can no longer inspect the traffic flowing to telemetry endpoints from my phone without rooting it. That's quite a pain in my opinion. I'm fine with being unable to see my bank's traffic, but I want to know why the MS launcher is uploading kilobytes of information every minute instead of just deleting it entirely. That's the downside of being a power user, of course; the features I want cannot be made available to the general public in good faith because bad governments and companies will abuse them.

I was wondering the same. Presumably Netflix would only work through the browser, not through the apps available for various platforms.

jeroenhd 6y ago

I've worked for a company that specializes in blocking certain websites for certain people (porn blocking stuff). The company used MitM-attacks with a custom TLS certificate, just like the Kazakh government uses. There's two ways to deal with certificate pinning. The first is to apply SNI sniffing (which will work until eSNI makes its way into more software) to determine that a certain domain is related to a certain, permissible service and bypass the decryption filter. This can be coupled with certificate validation to prevent domain fronting. The second method requires rooting the device and using a tool like Frida to automatically disable any validation checks. On Android and iOS there are special APIs to do certificate pinning but not all apps leverage them. Many apps will also work fine if you install the CA to the system partition instead of using the user store. App developers often don't know that certificate authorities are even a thing that can be managed by the user, let alone that the set can be extended, so most apps use the default setting, which has been to only trust system certificates. This was changed back during the release of Android 7, before that time all apps defaulted to trusting user-installed certificates. The third option, which any company or government can take to get off easily, is to blame the app for trying to break your righteous surveillance and to leave the apps broken. Netflix can be made to work any time, all they need to do is release a patch that disables certificate pinning, so if the government can get the public to blame the apps, they get off scot free. The first method works transparently to applications. The second requires physical access to the device and rooting the OS, which can be impossible. The third only works if the people you're surveilling take your side. I'd guess they pick option 1 or 3.

p410n3 6y ago
In security, certificate pinning is a good practice because it defends against, who guessed it, MITM.
- jeroenhd 6y ago
  Obviously. Few apps (outside the very big ones) actually do it though, and with root access any attempt at cert pinning is trivially bypassed of course. Annoyingly, many telemetry providers seem to have implemented cert pinning because I can no longer inspect the traffic flowing to telemetry endpoints from my phone without rooting it. That's quite a pain in my opinion. I'm fine with being unable to see my bank's traffic, but I want to know why the MS launcher is uploading kilobytes of information every minute instead of just deleting it entirely. That's the downside of being a power user, of course; the features I want cannot be made available to the general public in good faith because bad governments and companies will abuse them.