4 ms·

Does anyone know how the story currently is for MITM'ing Android? I had fun reverse engineering app APIs a few years back, but I looked into it again more rece

Does anyone know how the story currently is for MITM'ing Android? I had fun reverse engineering app APIs a few years back, but I looked into it again more recently and found that Android has started pinning certificates by default even on apps that didn't pin anything themselves. I also had trouble getting my custom certificate to be used at all, when it used to be pretty easy. Can Frida still bypass pinning, even this new default one, or is it done at OS level?

pimterry 5y ago
In short: * By default, all modern Android apps only trust CA system certificates, and on a normal device you cannot change those. * You can change system certificates on rooted devices and most (but not all) emulators. * Apps can opt-in to trusting user-installed CA certificates within their manifest config, but almost all don't. If you're on a non-rooted device, the only way to MITM traffic is by modifying the application itself, so that it opts into trusting your cert. You can either inject Frida-Gadget to do that, do it manually, or use https://github.com/shroudedcode/apk-mitm https://github.com/shroudedcode/apk-mitm which tries to do it automatically (but it's a bit hit & miss whether it works). If you're on an emulator/rooted device, it's totally possible, see https://httptoolkit.tech/blog/intercepting-android-https/#injecting-ca-certificates-into-rooted-devices https://httptoolkit.tech/blog/intercepting-android-https/#in... for how that works. That's separate to explicit certificate pinning. That's also possible on Android (with some standard config settings, or manually in code) although it's got much less popular I think since the defaults were tightened up. In that case you do usually need Frida, and it's generally easiest to just use a rooted device. I wrote a blog post about exactly how to do that last week: https://httptoolkit.tech/blog/frida-certificate-pinning/#how-can-you-remove-certificate-pinning-with-frida https://httptoolkit.tech/blog/frida-certificate-pinning/#how...
- mirashii 5y ago
  > By default, all modern Android apps only trust CA system certificates, and on a normal device you cannot change those. Sure you can. It's in a settings pane, Settings -> Security -> Encryption and Credentials -> Install a certificate. MDM profiles can also install certificates. There's pretty much zero possibility of this being removed as a feature as it is essential to a wide variety of corporate environments.
  - mumphster 5y ago
    This doesn’t bypass cert pinning in apps which was the original question
  - pimterry 5y ago
    Those certificates are user-added certificates, not system certificates. Android has two separate certificate stores, the UI only exposes the user certificate store, and by default apps only trust the system certificate store. This was changed back in 2016, the original announcement post has some good details: https://android-developers.googleblog.com/2016/07/changes-to-trusted-certificate.html https://android-developers.googleblog.com/2016/07/changes-to... Enterprises can add certificates to the system store I believe, but only as part of the initial provisioning of the device, and only for enterprise-managed devices.
    - GekkePrutser 5y ago
      Indeed, and such enterprise-management devices must be wiped for enrolment. There's some management modes which don't require that but they don't offer the ability to install system certs.
- stavros 5y ago
  I love you, Pim. I never thought to change the system CA store, I always thought they'd pin to their own cert anyway.

pimterry 5y ago

In short: * By default, all modern Android apps only trust CA system certificates, and on a normal device you cannot change those. * You can change system certificates on rooted devices and most (but not all) emulators. * Apps can opt-in to trusting user-installed CA certificates within their manifest config, but almost all don't. If you're on a non-rooted device, the only way to MITM traffic is by modifying the application itself, so that it opts into trusting your cert. You can either inject Frida-Gadget to do that, do it manually, or use https://github.com/shroudedcode/apk-mitm https://github.com/shroudedcode/apk-mitm which tries to do it automatically (but it's a bit hit & miss whether it works). If you're on an emulator/rooted device, it's totally possible, see https://httptoolkit.tech/blog/intercepting-android-https/#injecting-ca-certificates-into-rooted-devices https://httptoolkit.tech/blog/intercepting-android-https/#in... for how that works. That's separate to explicit certificate pinning. That's also possible on Android (with some standard config settings, or manually in code) although it's got much less popular I think since the defaults were tightened up. In that case you do usually need Frida, and it's generally easiest to just use a rooted device. I wrote a blog post about exactly how to do that last week: https://httptoolkit.tech/blog/frida-certificate-pinning/#how-can-you-remove-certificate-pinning-with-frida https://httptoolkit.tech/blog/frida-certificate-pinning/#how...

mirashii 5y ago
> By default, all modern Android apps only trust CA system certificates, and on a normal device you cannot change those. Sure you can. It's in a settings pane, Settings -> Security -> Encryption and Credentials -> Install a certificate. MDM profiles can also install certificates. There's pretty much zero possibility of this being removed as a feature as it is essential to a wide variety of corporate environments.
- mumphster 5y ago
  This doesn’t bypass cert pinning in apps which was the original question
- pimterry 5y ago
  Those certificates are user-added certificates, not system certificates. Android has two separate certificate stores, the UI only exposes the user certificate store, and by default apps only trust the system certificate store. This was changed back in 2016, the original announcement post has some good details: https://android-developers.googleblog.com/2016/07/changes-to-trusted-certificate.html https://android-developers.googleblog.com/2016/07/changes-to... Enterprises can add certificates to the system store I believe, but only as part of the initial provisioning of the device, and only for enterprise-managed devices.
  - GekkePrutser 5y ago
    Indeed, and such enterprise-management devices must be wiped for enrolment. There's some management modes which don't require that but they don't offer the ability to install system certs.
stavros 5y ago
I love you, Pim. I never thought to change the system CA store, I always thought they'd pin to their own cert anyway.