4 ms·

> Also, I'm miffed about how hard it is to mitmproxy apps on iOS to see what they are sending to servers. Did you ever try with Fiddler? You can allow local co

> Also, I'm miffed about how hard it is to mitmproxy apps on iOS to see what they are sending to servers. Did you ever try with Fiddler? You can allow local connections through your PC and proxy through, download a Fiddler root cert, and it should work.

jrockway 5y ago
I think the underlying problem is that the apps stop talking because the certificate validity check fails when traffic is proxied through your MITM. No MITM proxy can make that succeed, but if you can control the CA store that apps read, then you can create a certificate, add it to the trusted roots, use that cert to sign a certificate for someone else's website, and then when the app uses the system library to verify the validity of the certificate, it will appear valid, even though it's not. Without being able to hack the certificate verification, you can't MITM traffic between two devices you own. I think that's the complaint the grandparent has. Apps can still pin certificates, of course. At that point, you have to exploit the app's other faulty assumptions like "I'm running the same code that the compiler produced" or "writing 0 to memory address 0x12344321 and then reading memory address 0x12344321 will result in reading 0", which are straightforward to make false. Though probably not on a stock iPhone.
- ROARosen 5y ago
  Are you saying that most apps don't rely on the system Trust Store? I believe manually trusting Fiddler's cert adds it to the Trust Store. The only iOS apps I couldn't successfully MITM with this were stock Apple apps.
  - llacb47 5y ago
    Try Twitter, Instagram, Twitch, etc.
  - judge2020 5y ago
    What happens is that apps don't work if their cert is issued by another CA, eg. "we only use digicert so any other CA issuing us is either attacking us or a enterprise/hobbyist MITM which we don't care about anyways".
  - TechBro8615 5y ago
    I would bet that > 75% of the top 50 apps use SSL pinning. Apple makes it really easy to do and it's an obvious first defense against reverse engineering.

jrockway 5y ago

I think the underlying problem is that the apps stop talking because the certificate validity check fails when traffic is proxied through your MITM. No MITM proxy can make that succeed, but if you can control the CA store that apps read, then you can create a certificate, add it to the trusted roots, use that cert to sign a certificate for someone else's website, and then when the app uses the system library to verify the validity of the certificate, it will appear valid, even though it's not. Without being able to hack the certificate verification, you can't MITM traffic between two devices you own. I think that's the complaint the grandparent has. Apps can still pin certificates, of course. At that point, you have to exploit the app's other faulty assumptions like "I'm running the same code that the compiler produced" or "writing 0 to memory address 0x12344321 and then reading memory address 0x12344321 will result in reading 0", which are straightforward to make false. Though probably not on a stock iPhone.

ROARosen 5y ago
Are you saying that most apps don't rely on the system Trust Store? I believe manually trusting Fiddler's cert adds it to the Trust Store. The only iOS apps I couldn't successfully MITM with this were stock Apple apps.
- llacb47 5y ago
  Try Twitter, Instagram, Twitch, etc.
- judge2020 5y ago
  What happens is that apps don't work if their cert is issued by another CA, eg. "we only use digicert so any other CA issuing us is either attacking us or a enterprise/hobbyist MITM which we don't care about anyways".
- TechBro8615 5y ago
  I would bet that > 75% of the top 50 apps use SSL pinning. Apple makes it really easy to do and it's an obvious first defense against reverse engineering.