3 ms·

Since Android Nougat I think you cannot install user certificates unless you: 1. Root your device. 2. Add the certificate to the APK manifest. I'm not well ver

by almog 5y ago

Since Android Nougat I think you cannot install user certificates unless you: 1. Root your device. 2. Add the certificate to the APK manifest. I'm not well versed in Android changes, this is just the conclusion I came to when Nougat came out and haven't tried it again since. If there's an easier way to use MITM with Android without modifying the APK / rooting your device, I'd love to know!

tprynn 5y ago
This is true, by default Android apps do not trust user-installed certificate authorities. IMO the easiest solution if you're doing security testing on a dedicated device is MagiskTrustUserCerts[1]. If you're not testing on a dedicated device or you don't want to root the device, I'd recommend using the objection[2] tool which has a guided mode for patching an apk, and you can modify the manifest to add your CA or to trust all user-installed CAs. [1]: https://github.com/NVISOsecurity/MagiskTrustUserCerts https://github.com/NVISOsecurity/MagiskTrustUserCerts [2]: https://github.com/sensepost/objection/wiki/Patching-Android-Applications https://github.com/sensepost/objection/wiki/Patching-Android...
- almog 5y ago
  Neat! Both Magisk (which I might use on an older phone which I don't mind rooting) and Objection are new to me, thank you!
jeroenhd 5y ago
You can install certificates just fine, but apps need to opt in to use user certificates. You can MitM apps that have this flag enabled, but very few mobile developers seem to even know what TLS is, let alone how and why you should change trust store settings. With root access, you can put your certificate in the root store, which most apps use for validation. I wrote a blog about it around the time Android 7 came out. Some apps (either not enough or too many, depending on your perspective) leverage Android's certificate pinning feature to connect a domain to a specific TLS certificate. You can't MitM those apps without either modifying the APK or hijacking them via Frida. Lastly, if you want to MitM Firefox, you need to enable their secret debug menu (available on some builds) to enable the flag that enables user certificates. Flagging the relevant setting in about:config does not work and about:config isn't even accessible on stable builds of Firefox for Android. Sadly, there's no good way to MitM an Android device without full system access. Android has always been quite annoying to use custom CA certs for, but since Android 7 it's pretty much impossible without root access. I'm not entirely sure why they went this route instead of sticking to their existing warnings (i.e. a notification every time a custom CA gets used, like in Android 4, and a constant "your network may be monitored" label in the notification tray like in Android 5+).
- almog 5y ago
  You are right, I didn't phrase it correctly, what I is meant that since Nougat I'm not aware of way to force system-wide use of a user certificate without gaining root access. Thanks for the Firefox tip as well, it's been a while since I used Mitmproxy and I see things have not become easier since.

by almog 5y ago

tprynn 5y ago

This is true, by default Android apps do not trust user-installed certificate authorities. IMO the easiest solution if you're doing security testing on a dedicated device is MagiskTrustUserCerts[1]. If you're not testing on a dedicated device or you don't want to root the device, I'd recommend using the objection[2] tool which has a guided mode for patching an apk, and you can modify the manifest to add your CA or to trust all user-installed CAs. [1]: https://github.com/NVISOsecurity/MagiskTrustUserCerts https://github.com/NVISOsecurity/MagiskTrustUserCerts [2]: https://github.com/sensepost/objection/wiki/Patching-Android-Applications https://github.com/sensepost/objection/wiki/Patching-Android...

almog 5y ago
Neat! Both Magisk (which I might use on an older phone which I don't mind rooting) and Objection are new to me, thank you!

jeroenhd 5y ago

You can install certificates just fine, but apps need to opt in to use user certificates. You can MitM apps that have this flag enabled, but very few mobile developers seem to even know what TLS is, let alone how and why you should change trust store settings. With root access, you can put your certificate in the root store, which most apps use for validation. I wrote a blog about it around the time Android 7 came out. Some apps (either not enough or too many, depending on your perspective) leverage Android's certificate pinning feature to connect a domain to a specific TLS certificate. You can't MitM those apps without either modifying the APK or hijacking them via Frida. Lastly, if you want to MitM Firefox, you need to enable their secret debug menu (available on some builds) to enable the flag that enables user certificates. Flagging the relevant setting in about:config does not work and about:config isn't even accessible on stable builds of Firefox for Android. Sadly, there's no good way to MitM an Android device without full system access. Android has always been quite annoying to use custom CA certs for, but since Android 7 it's pretty much impossible without root access. I'm not entirely sure why they went this route instead of sticking to their existing warnings (i.e. a notification every time a custom CA gets used, like in Android 4, and a constant "your network may be monitored" label in the notification tray like in Android 5+).

almog 5y ago
You are right, I didn't phrase it correctly, what I is meant that since Nougat I'm not aware of way to force system-wide use of a user certificate without gaining root access. Thanks for the Firefox tip as well, it's been a while since I used Mitmproxy and I see things have not become easier since.