17 ms·

Android Chrome 99 expands Certificate Transparency, breaking all MitM dev tools

288 points by pimterry 4y ago

rektide 4y ago
Google keeps seeming like an advanced persistent threat to an understandable world. More and more effort keeps getting poured into insuring software takes precedence over humanity, that we get no say. The recent banning of sideloaded accessibility apps is another blood curddling cry against agency, another slamming shut of the door. This totalization of security concerns is such a horrifying behavior to have emerged in the past half decade, especially from a company so strongly linked to the web and which used to have such clear positive values.
- hypertele-Xii 4y ago
  On the other hand, if Google vanished today, the only effect it'd have on my life is that I'd watch something other than YouTube.
  - vmception 4y ago
    Lucky you So no email you have from an employer, school, sideproject, personal is gmail based? No shared document you are storing or access is google docs based? At least everyone making calendar invites will quickly move to something else I’m just really surprised you’ve managed to do this and are content
    - sieabahlpark 4y ago
      Well it'd be gone anyway, I'd just use one of my other emails.
    - unethical_ban 4y ago
      In my personal life, YouTube is the only thing that seems irreplaceable. My contacts are in Google as well, but i have non Google for all backups and email and search. In fact, I'm considering a switch to Apple just to try out a completely deGoogled routine (barring work email).
    - hypertele-Xii 4y ago
      I actually de-Googled myself very recently. Got my own domain, own email, and use SyncThing between devices.
      - Melatonic 4y ago
        The only effect it would have is that tons and tons of people would suddenly be asking you for help on how to live without their Google handholding overlords :-D
- jeroenhd 4y ago
  The "ban" on externally installed accessibility apps is nothing more than two extra button presses to enable APIs that are used by real-world malware to steal money. Alternative app stores like F-Droid are exempt from the change, assuming they use the correct API, and apps you manually installed can still be given the necessary permissions. It's just harder to do when you don't know what you're doing, which is a good thing in my opinion.
  - josephcsible 4y ago
    If it were just two extra button presses then it would be fine. The problem is that if you try to use a sideloaded accessibility app without pressing them, the error Google gives you tells you that it's completely impossible, and doesn't mention the button presses.
  - rektide 4y ago
    That is less bad than I thought. Manifest v3 & it's forbidding of dynamic code is another major treason, in my view, an uncompromising & cruel stance to force upon the web. I'm less knowledgable here, but I also feel like there's a bit of a hostile relationship with works like Magisk on Android, which have long had an uneasy relationship, albeit the recent v24 & it's new Zygisk zygote injection shows a lot of health & excitement right now. The ever encroaching desire to drive top-down control is highly visible in SafetyNet, which make it clear the device in your hand serves corporations, not you.
    - SquareWheel 4y ago
      If by Manifest v3 you're referring to declarativeNetRequest, then that's supported dynamic rules since 2019[1][2]. If you mean disallowing importing remote code, that's to prevent malware from hiding in Chrome extensions until after being published. [1] https://developer.chrome.com/docs/extensions/reference/declarativeNetRequest/#dynamic-and-session-scoped-rules https://developer.chrome.com/docs/extensions/reference/decla... [2] https://blog.chromium.org/2019/06/web-request-and-declarative-net-request.html https://blog.chromium.org/2019/06/web-request-and-declarativ...
- no_time 4y ago
  >Google keeps seeming like an advanced persistent threat to an understandable world. More and more effort keeps getting poured into insuring software takes precedence over humanity, that we get no say. Truth. However this is a blip on the radar compared to the treacherous monstrosity that is the play integrity api https://developer.android.com/google/play/integrity https://developer.android.com/google/play/integrity
georgiecasey 4y ago
so this breaks charles proxy HTTPS sniffing as well? I haven't encountered the problem yet even though my Android Chrome is version 101
- deleted 4y ago
  [deleted]
- matt_heimer 4y ago
  It doesn't break Charles Proxy unless you installed your CA cert in a method that is typically used by httptoolkit (installing in the system store). What is broken is installing a custom CA into the system store on a rooted phone and making it work with all apps (apks) and Chrome. If you install the custom CA into the user store it'll still work with Chrome. If you want to use Charles to inspect the HTTPS traffic of an app you are developing then you continue to follow the instructions from https://www.charlesproxy.com/documentation/using-charles/ssl-certificates/ https://www.charlesproxy.com/documentation/using-charles/ssl... to configure your test build to use the user store CA certs. If you want to use Charles to inspect apps from other developers then you need to rebuild them to trust the user store just like you would if you were developing the app yourself. Use https://github.com/shroudedcode/apk-mitm https://github.com/shroudedcode/apk-mitm to automate that process. httptoolkit uses the method they do because it was the easiest way to get setup to inspect everything. Its tedious to get every app setup to trust the user store.
  - georgiecasey 4y ago
    > What is broken is installing a custom CA into the system store on a rooted phone and making it work with all apps (apks) and Chrome. yep, that's what I do. still seems to work here though. I'm scared to reboot
holoduke 4y ago
How long before Google only accepts Google signed certificates. Everything must and shall be placed within the Google ecosystem. Not good.
- asdf1asdf 4y ago
- woodruffw 4y ago
  CT is a PKI ecosystem thing, not a Google thing. Google hosts one of the CT logs for HTTPS certificates, but so do other major companies: Cloudflare and DigiCert come to mind. Let's Encrypt even has one.
oefrha 4y ago
I always find it highly ironic that I can trivially MitM my non-jailbroken iPhone to inspect app traffic (unless the app uses cert pinning), but MitM'ing on a non-jailbroken Android phone is a huge pain in the ass, basically impossible without patching binaries (please correct me if I'm wrong).
- codys 4y ago
  what tools/methods exist for MitM-ing iphone traffic in this case?
  - oefrha 4y ago
    Any tool? Install a profile, enable your cert, set a proxy, off you go. Charles, mitmproxy, Fiddler, whatever you prefer.
- bspammer 4y ago
  On the other hand if the app does use cert pinning, it's much easier on Android because we have https://github.com/shroudedcode/apk-mitm https://github.com/shroudedcode/apk-mitm
  - oefrha 4y ago
    That’s true.
  - xg15 4y ago
    If you're already patching the APK, couldn't you also patch it to trust the user store, even if the app doesn't use cert pinning?
- jeroenhd 4y ago
  Loading certificates into the phone is as easy as opening the files. The problem here is that Android apps have to opt in to loading user-imported certificates. Chrome and many other browsers will load these certificates just fine if you install them the official way. Apps that specify they trust the user store will also load them without any issues. The method that's now broken fails because the author is using a workaround: with root permissions, the system store can be altered, which apps do trust by default. Chrome, however, is following best practices and enforces that certificates are logged in the certificate transparency log. This isn't done for user-imported certificates for obvious reasons, but it's applied to system certificates to prevent rogue CAs from faking certificates without exposing themselves to the world. This means the workaround no longer works, or at least not as easily. There are still workarounds to fix the workaround, like the flags the author suggests here. It was never a supported way of doing things and unsupported workarounds are bound to break at some point. I don't know how iOS deals with certificates, I suspect it's something sensible when the normal API is used (opt-out of user certificates, that is). However, apps like social media and messengers will often include certificate pinning that is impossible to get around without jailbreaks + modifying runtime code through tools like Frida. They include the hash of their (intermediary) certificates in the application itself and validate that the chain is signed by a valid certificate with that specific hash. That way, a malicious certificate authority can give out a "valid" certificate that's useless for MitM-ing your app's users!
lesgobrandon 4y ago
jeroenhd 4y ago
Note that this only counts for certificates in the system store. As far as I know, certificates stores in the user store (the one you use when you import a certificate through the UI) will override this requirement and work just fine. The underlying problem is that apps stopped trusting user certificates by default in Android 7 so security researchers have had to root their devices and store certs in the system store. Theoretically this should work if you can manage to get the certificate in both the system and the user store, though I don't think you can do that. I'm thinking something like this: you add the root certificate to your system store so most applications will trust it; then you create an intermediate certificate authority for your MitM-ing (which you should probably do anyway if you're doing this long term) and import that certificate into the user store. Hopefully, that way Chrome will see the user store intermediate certificate and validate it using the non-CT algorithm. I haven't tried it, though! Note that for MitM-ing Firefox, you need to access the secret dev settings (go to about, hit the Firefox logo seven times to enable them) and enable loading user store certificates.
- justsomehnguy 4y ago
  > The underlying problem is that apps stopped trusting user certificates by default in Android 7 The other casualty were the people who use their own CAs. It took me some time to grok what the problem with some apps (which didn't want to connect) wasn't in my server configuration, but the certs they served. TLS-ALPN somewhat alleviates this problem, but still requires to have some real presence on the net.
- Melatonic 4y ago
  This is the real answer. While I of course support hardening security I have to think that Google has other motivations by introducing these restrictions on the system cert store. There are legitimate use cases where you want want to MITM yourself (or your employer). This combined with cert pinning combined with use of encrypted DNS (which is definitely not a bad thing in it of itself) means that Google is going to keep having access to useful tracking data.
  - spacexsucks 4y ago
Spivak 4y ago
Ya know what, good. It sucks that dev tools caught in the crossfire here but anything to put another nail in the broken corporate mitm "security" appliances is a huge win. Along with encrypted DNS we might actually reach nirvana of "either give me a clean connection to the public internet or don't but no stupid half broken middle."
- unethical_ban 4y ago
  As a network security person, if you can't MitM, then monitoring and filtering will simply move to the endpoint. Monitoring is an absolute necessity and positive thing on certain networks.
  - Spivak 4y ago
    You're describing the world everyone wants. I would much rather OS's move to a system with a filtering API so I can get real errors like "connection not allowed by local security policy" instead of pretending like it works and then dropping packets or getting garbage responses from the appliance pretending to be my server.
    - dane-pgp 4y ago
      Of course what we'll actually get is networks which require[0] your OS to attest that you are running in Secure Boot mode, so the network can ensure you are running an "approved" OS that prevents you from running VPNs or Tor or bittorrent or E2EE messengers... [0] https://arstechnica.com/gaming/2021/09/riot-games-anti-cheat-software-will-require-tpm-secure-boot-on-windows-11/ https://arstechnica.com/gaming/2021/09/riot-games-anti-cheat...
    - unethical_ban 4y ago
      Hey, I hear you. That just means I'll have to get good at a different UI!
    - xg15 4y ago
      Ok, but filter on what criteria? If the connection is encrypted, how do you know what you should filter for?
technofiend 4y ago
If you've ever tried to use 802.1x / EAP on Android then you've already had a taste of this issue. Android makes importing and trusting a new root certificate authority very difficult. At least in my experience the device constantly pops up warnings about the root ca, despite using the appropriate import options. And if you're paranoid enough to use wifi client authentication, then you probably don't want anyone else to issue certs for your devices. On one hand it's commendable that Google makes it hard on malicious actors, but on the other there are legitimate use cases for importing your own root CAs and using something stronger than WEP is just one of them.
- hackmiester 4y ago
  This is seriously such a joke because for years Android had a “don’t check certificate” option for 802.1X. It was unique among the most popular client OSes in allowing this extremely unsafe configuration, which is way worse than “trust on first use” (the least secure option in iOS). And now suddenly a total 180, they are extremely anal about certificates to the point that 802.1X is very hard to use. Thanks a lot gang.
  - jeroenhd 4y ago
    My university used to recommend explicitly selecting "do not validate" for the longest time, even though validation through the system store (or a certificate of your choice) has existed for years. For what it's worth, if you're using a valid TLS certificate for your 802.1x setup then you don't need to load any certificates anymore (at least not since Android 10 or 11). Users may need to enter a domain to validate, though; I don't know the specifics of these protocols.
    - Avamander 4y ago
      It's unfortunate that the SSID can't be automatically used as the domain on the TLS certificate.
      - hackmiester 4y ago
Szpadel 4y ago
that's super anoying, as of some time you do not see cors requests in dev tools and basically only way to debug those issues was to use mitmproxy, and that's now also unnecessary complicated There is also env SSLKEYLOGFILE, that you can use on connection with Wireshark, but I didn't tested that yet with chrome I understand why it's nice from security point of view, but adding option to disable those in chrome://flags would be much better way
- xg15 4y ago
  > I understand why it's nice from security point of view With no way to disable this, it seems more about the security of the apps than about the security of the user.
bitwize 4y ago
But how will zScaler provide extra security for your corporate apps on Android now?
- verifex 4y ago
  Jailbroken androids for the enterprise! What could possibly go wrong?
NovemberWhiskey 4y ago
Isn't there an enterprise policy for disabling CT for certain CAs in Chrome?
- Melatonic 4y ago
  I believe there is for desktop but I am not sure on mobile. and I am not entirely sure if (without the browser enrolled) it would even be possible for the end user to control this.
new_user_final 4y ago
This and side-loaded accessibility threads are making me rethink how stupid people are. Please read and try to understand before typing something on your keyboard that will make you look like a stupid.
xg15 4y ago
I was kind of believing that most apps would use certificate pinning anyway, so I was kinda surprised manipulating the system store is actually workable. Though if modifying the system store is indeed officially "unsupported" my guess is it's only a matter of time before CT is enforced by the standard Android TLS API and will apply to apps as well. In which case I guess the next step would be... Add a fake CT log in addition to the fake root CA? But anyway, stuff like this confirms my impression that Android sides with app developers more than it sides with users when it comes to analysing traffic of your own devices.
- nokya 4y ago
  Certificate pinning is a big problem for corporate environments: large companies install CA certificates in their endpoints to allow centralized traffic inspection. Apps that enforce certificate pining cannot operate properly in these networks. It can be a desired function sometimes (e.g., a bank that wants to protect its customers) but in most situations it comes back at their face (i.e., bank customer wants to manage his bank account from his work office). About your conclusion, I fully agree with you. It is not about protecting users but about protecting Google. Let's not ignore the other fact that Chrome started hiding some requests from its Network panel (e.g., CORS) for "our own good", which makes network-layer inspection even more necessary.
mhils 4y ago
Enforcing CT is good, but that doesn't excuse the treatment of user-added CAs. On all platforms but Android, user-added CAs are considered particularly trustworthy. For example, Chrome Desktop, Firefox, and IE did not enforce HPKP if they encountered a cert from a user-added CA. Why does Android do the opposite? I don't see the threat model they are addressing. We (mitmproxy) have repeatedly tried to get an answer to this from the Android folks (e.g. here: https://github.com/mitmproxy/mitmproxy/issues/2054#issuecomment-282585162 https://github.com/mitmproxy/mitmproxy/issues/2054#issuecomm...). It very much feels like they just want to kill uncomfortable privacy research.
- midasuni 4y ago
  I want to add a user ÇA but only for a certain sites. If I’m developing on blah.com, I’m happy to add a root certificate, but I want to choose what sites (blah.com, blah.de, etc) I trust that very to accept, I don’t want it doing bank.com because I don’t trust my own CA management to be infallible. Name constraints are poorly supported, and even then that again relies on me creating the root cert correctly. Browsers seem to give me the user the choice of either accepting the cert fully or not accepting it, not giving me the control. Why is that.
  - smw 4y ago
    Yes! Thank you! So many use cases!
- heavyset_go 4y ago
  You're right on the money, and they don't want people reversing APIs, either.
  - aliswe 4y ago
    who doesn't want you reversing their apis, Google? Oh ..
- no_time 4y ago
  >For example, Chrome Desktop, Firefox, and IE did not enforce HPKP if they encountered a cert from a user-added CA. They have no teeth on these platforms (as of now). Contrary to this, Android has been engineered from the ground up to make it's inner workings as opaque and unflexible as possible.
1vuio0pswjnm7 4y ago
"Browsers receiving this traffic enforce that all certificates they receive come with a matching SCT, signed by a log provider they trust." Interesting the word is "they" and not "you". Assuming "they" means the "tech" companies that provide these browsers and "you" means the computer owner. Computer owners are usually given the run-time option to remove "trusted" root certificates that are pre-installed with browsers like Chrome. That is, remove them from the current list of trusted root certificates, not remove them from the source code. In a more perfect world, more computer owners could compile their own browsers,[FN1] thereby giving them the opportunity (freedom of choice) to remove untrusted certificates from the source code, as well as to add their own. Not to mention make other useful changes suitable to their own needs. Can the computer owner remove a "trusted" log provider. Can the computer owner add their own log provider. FN1. I prefer to rely on a localhost proxy to perform TLS instead of the browser. One benefit is that I can read, edit and compile the proxy source code myself, quickly and easily. Unlike the graphical browser from the online ad services "tech" company, the author(s) of the proxy are not compromised by a pecuniary interest in selling and delivering programmatic advertising services, and the ability to use an in-house browser to support that pernicious endeavour. In using a proxy, I am not having to fight against the interests of the paternalistic browser vendor in order to protect my own.
- y4mi 4y ago
  > I prefer to rely on a proxy to perform TLS instead of the browser. That's one step forward and about 30 steps backwards if you're actually doing that for security. Proxies silently accept broken TLS configuration all the time and serve then to you as https secured. You're unlikely to encounter invalid https configurations nowadays, so you likely won't ever notice, but it's definitely less secure to break the TLS connection in the proxy
  - zzo38computer 4y ago
    > Proxies silently accept broken TLS configuration all the time I don't want the browser to enforce TLS configuration; the proxy could be configurable to set it how I want it to accept or not accept broken TLS configurations.
Animats 4y ago
"HTTP Toolkit gives you one-click HTTP(S) interception, inspection & mocking for any Android app." There's kind of a vested interest here. It would probably be sufficient to allow cert bypass in a desktop Android phone emulator, such as Android Studio. That's intended for debug and test. Nobody uses that for non-debug use by mistake.
Anunayj 4y ago
Can I simply not choose the CT log I want to use and host my own CT log with my certs in there? If I can't doesn't this mean this effectively makes it so my cert has to be in Google's CT logs to be valid.
lokar 4y ago
The flag he mentions seems like a reasonable way to support the debugging use case. It's more to setup, but people doing this should already be using automation to install the cert, etc.
1vuio0pswjnm7 4y ago
An issue not mentioned in this is that at the office it is routine to MITM TLS connections, what some call "TLS inspection".[FN1] There are important reasons for performing TLS inspection aside from "developers testing their smartphone app" or "security research". An employer should want to see the contents of what is traversing the employer's network. The employer owns the network so she gets to decide. A home computer user should want to see the contents of what is traversing the home computer user's network. The home computer user owns the network so she gets to decide. Anything, apps from "tech" companies, that interferes with the ability of the network owner to see the contents of that traffic is a threat. FN1. https://security.stackexchange.com/questions/107542/is-it-common-practice-for-companies-to-mitm-https-traffic https://security.stackexchange.com/questions/107542/is-it-co... https://fak3r.com/2015/07/22/your-employer-runs-ssl-mitm-attacks-on-you/ https://fak3r.com/2015/07/22/your-employer-runs-ssl-mitm-att... https://www.quora.com/Why-are-companies-trying-to-inspect-SSL-TLS-traffic-of-their-employees https://www.quora.com/Why-are-companies-trying-to-inspect-SS... https://it.slashdot.org/story/14/03/05/1724237/ask-slashdot-does-your-employer-perform-https-mitm-attacks-on-employees https://it.slashdot.org/story/14/03/05/1724237/ask-slashdot-... https://www.schneier.com/blog/archives/2019/11/the_nsa_warns_o.html https://www.schneier.com/blog/archives/2019/11/the_nsa_warns... https://attack.mitre.org/mitigations/M1020/ https://attack.mitre.org/mitigations/M1020/
- josephcsible 4y ago
  Are you okay if your ISP starts MITM'ing all of your TLS traffic, since they own the network you're connecting to?
  - 1vuio0pswjnm7 4y ago
    Who owns the data.

288 points by pimterry 4y ago

Google keeps seeming like an advanced persistent threat to an understandable world. More and more effort keeps getting poured into insuring software takes precedence over humanity, that we get no say. The recent banning of sideloaded accessibility apps is another blood curddling cry against agency, another slamming shut of the door. This totalization of security concerns is such a horrifying behavior to have emerged in the past half decade, especially from a company so strongly linked to the web and which used to have such clear positive values.

hypertele-Xii 4y ago
On the other hand, if Google vanished today, the only effect it'd have on my life is that I'd watch something other than YouTube.
- vmception 4y ago
  Lucky you So no email you have from an employer, school, sideproject, personal is gmail based? No shared document you are storing or access is google docs based? At least everyone making calendar invites will quickly move to something else I’m just really surprised you’ve managed to do this and are content
  - sieabahlpark 4y ago
    Well it'd be gone anyway, I'd just use one of my other emails.
  - unethical_ban 4y ago
    In my personal life, YouTube is the only thing that seems irreplaceable. My contacts are in Google as well, but i have non Google for all backups and email and search. In fact, I'm considering a switch to Apple just to try out a completely deGoogled routine (barring work email).
  - hypertele-Xii 4y ago
    I actually de-Googled myself very recently. Got my own domain, own email, and use SyncThing between devices.
    - Melatonic 4y ago
      The only effect it would have is that tons and tons of people would suddenly be asking you for help on how to live without their Google handholding overlords :-D
jeroenhd 4y ago
The "ban" on externally installed accessibility apps is nothing more than two extra button presses to enable APIs that are used by real-world malware to steal money. Alternative app stores like F-Droid are exempt from the change, assuming they use the correct API, and apps you manually installed can still be given the necessary permissions. It's just harder to do when you don't know what you're doing, which is a good thing in my opinion.
- josephcsible 4y ago
  If it were just two extra button presses then it would be fine. The problem is that if you try to use a sideloaded accessibility app without pressing them, the error Google gives you tells you that it's completely impossible, and doesn't mention the button presses.
- rektide 4y ago
  That is less bad than I thought. Manifest v3 & it's forbidding of dynamic code is another major treason, in my view, an uncompromising & cruel stance to force upon the web. I'm less knowledgable here, but I also feel like there's a bit of a hostile relationship with works like Magisk on Android, which have long had an uneasy relationship, albeit the recent v24 & it's new Zygisk zygote injection shows a lot of health & excitement right now. The ever encroaching desire to drive top-down control is highly visible in SafetyNet, which make it clear the device in your hand serves corporations, not you.
  - SquareWheel 4y ago
    If by Manifest v3 you're referring to declarativeNetRequest, then that's supported dynamic rules since 2019[1][2]. If you mean disallowing importing remote code, that's to prevent malware from hiding in Chrome extensions until after being published. [1] https://developer.chrome.com/docs/extensions/reference/declarativeNetRequest/#dynamic-and-session-scoped-rules https://developer.chrome.com/docs/extensions/reference/decla... [2] https://blog.chromium.org/2019/06/web-request-and-declarative-net-request.html https://blog.chromium.org/2019/06/web-request-and-declarativ...
no_time 4y ago
>Google keeps seeming like an advanced persistent threat to an understandable world. More and more effort keeps getting poured into insuring software takes precedence over humanity, that we get no say. Truth. However this is a blip on the radar compared to the treacherous monstrosity that is the play integrity api https://developer.android.com/google/play/integrity https://developer.android.com/google/play/integrity

georgiecasey 4y ago

so this breaks charles proxy HTTPS sniffing as well? I haven't encountered the problem yet even though my Android Chrome is version 101

deleted 4y ago
[deleted]
matt_heimer 4y ago
It doesn't break Charles Proxy unless you installed your CA cert in a method that is typically used by httptoolkit (installing in the system store). What is broken is installing a custom CA into the system store on a rooted phone and making it work with all apps (apks) and Chrome. If you install the custom CA into the user store it'll still work with Chrome. If you want to use Charles to inspect the HTTPS traffic of an app you are developing then you continue to follow the instructions from https://www.charlesproxy.com/documentation/using-charles/ssl-certificates/ https://www.charlesproxy.com/documentation/using-charles/ssl... to configure your test build to use the user store CA certs. If you want to use Charles to inspect apps from other developers then you need to rebuild them to trust the user store just like you would if you were developing the app yourself. Use https://github.com/shroudedcode/apk-mitm https://github.com/shroudedcode/apk-mitm to automate that process. httptoolkit uses the method they do because it was the easiest way to get setup to inspect everything. Its tedious to get every app setup to trust the user store.
- georgiecasey 4y ago
  > What is broken is installing a custom CA into the system store on a rooted phone and making it work with all apps (apks) and Chrome. yep, that's what I do. still seems to work here though. I'm scared to reboot

holoduke 4y ago

How long before Google only accepts Google signed certificates. Everything must and shall be placed within the Google ecosystem. Not good.

asdf1asdf 4y ago
woodruffw 4y ago
CT is a PKI ecosystem thing, not a Google thing. Google hosts one of the CT logs for HTTPS certificates, but so do other major companies: Cloudflare and DigiCert come to mind. Let's Encrypt even has one.

oefrha 4y ago

I always find it highly ironic that I can trivially MitM my non-jailbroken iPhone to inspect app traffic (unless the app uses cert pinning), but MitM'ing on a non-jailbroken Android phone is a huge pain in the ass, basically impossible without patching binaries (please correct me if I'm wrong).

codys 4y ago
what tools/methods exist for MitM-ing iphone traffic in this case?
- oefrha 4y ago
  Any tool? Install a profile, enable your cert, set a proxy, off you go. Charles, mitmproxy, Fiddler, whatever you prefer.
bspammer 4y ago
On the other hand if the app does use cert pinning, it's much easier on Android because we have https://github.com/shroudedcode/apk-mitm https://github.com/shroudedcode/apk-mitm
- oefrha 4y ago
  That’s true.
- xg15 4y ago
  If you're already patching the APK, couldn't you also patch it to trust the user store, even if the app doesn't use cert pinning?
jeroenhd 4y ago
Loading certificates into the phone is as easy as opening the files. The problem here is that Android apps have to opt in to loading user-imported certificates. Chrome and many other browsers will load these certificates just fine if you install them the official way. Apps that specify they trust the user store will also load them without any issues. The method that's now broken fails because the author is using a workaround: with root permissions, the system store can be altered, which apps do trust by default. Chrome, however, is following best practices and enforces that certificates are logged in the certificate transparency log. This isn't done for user-imported certificates for obvious reasons, but it's applied to system certificates to prevent rogue CAs from faking certificates without exposing themselves to the world. This means the workaround no longer works, or at least not as easily. There are still workarounds to fix the workaround, like the flags the author suggests here. It was never a supported way of doing things and unsupported workarounds are bound to break at some point. I don't know how iOS deals with certificates, I suspect it's something sensible when the normal API is used (opt-out of user certificates, that is). However, apps like social media and messengers will often include certificate pinning that is impossible to get around without jailbreaks + modifying runtime code through tools like Frida. They include the hash of their (intermediary) certificates in the application itself and validate that the chain is signed by a valid certificate with that specific hash. That way, a malicious certificate authority can give out a "valid" certificate that's useless for MitM-ing your app's users!

lesgobrandon 4y ago

jeroenhd 4y ago

Note that this only counts for certificates in the system store. As far as I know, certificates stores in the user store (the one you use when you import a certificate through the UI) will override this requirement and work just fine. The underlying problem is that apps stopped trusting user certificates by default in Android 7 so security researchers have had to root their devices and store certs in the system store. Theoretically this should work if you can manage to get the certificate in both the system and the user store, though I don't think you can do that. I'm thinking something like this: you add the root certificate to your system store so most applications will trust it; then you create an intermediate certificate authority for your MitM-ing (which you should probably do anyway if you're doing this long term) and import that certificate into the user store. Hopefully, that way Chrome will see the user store intermediate certificate and validate it using the non-CT algorithm. I haven't tried it, though! Note that for MitM-ing Firefox, you need to access the secret dev settings (go to about, hit the Firefox logo seven times to enable them) and enable loading user store certificates.

justsomehnguy 4y ago
> The underlying problem is that apps stopped trusting user certificates by default in Android 7 The other casualty were the people who use their own CAs. It took me some time to grok what the problem with some apps (which didn't want to connect) wasn't in my server configuration, but the certs they served. TLS-ALPN somewhat alleviates this problem, but still requires to have some real presence on the net.
Melatonic 4y ago
This is the real answer. While I of course support hardening security I have to think that Google has other motivations by introducing these restrictions on the system cert store. There are legitimate use cases where you want want to MITM yourself (or your employer). This combined with cert pinning combined with use of encrypted DNS (which is definitely not a bad thing in it of itself) means that Google is going to keep having access to useful tracking data.
- spacexsucks 4y ago

Spivak 4y ago

Ya know what, good. It sucks that dev tools caught in the crossfire here but anything to put another nail in the broken corporate mitm "security" appliances is a huge win. Along with encrypted DNS we might actually reach nirvana of "either give me a clean connection to the public internet or don't but no stupid half broken middle."

unethical_ban 4y ago
As a network security person, if you can't MitM, then monitoring and filtering will simply move to the endpoint. Monitoring is an absolute necessity and positive thing on certain networks.
- Spivak 4y ago
  You're describing the world everyone wants. I would much rather OS's move to a system with a filtering API so I can get real errors like "connection not allowed by local security policy" instead of pretending like it works and then dropping packets or getting garbage responses from the appliance pretending to be my server.
  - dane-pgp 4y ago
    Of course what we'll actually get is networks which require[0] your OS to attest that you are running in Secure Boot mode, so the network can ensure you are running an "approved" OS that prevents you from running VPNs or Tor or bittorrent or E2EE messengers... [0] https://arstechnica.com/gaming/2021/09/riot-games-anti-cheat-software-will-require-tpm-secure-boot-on-windows-11/ https://arstechnica.com/gaming/2021/09/riot-games-anti-cheat...
  - unethical_ban 4y ago
    Hey, I hear you. That just means I'll have to get good at a different UI!
  - xg15 4y ago
    Ok, but filter on what criteria? If the connection is encrypted, how do you know what you should filter for?

technofiend 4y ago

If you've ever tried to use 802.1x / EAP on Android then you've already had a taste of this issue. Android makes importing and trusting a new root certificate authority very difficult. At least in my experience the device constantly pops up warnings about the root ca, despite using the appropriate import options. And if you're paranoid enough to use wifi client authentication, then you probably don't want anyone else to issue certs for your devices. On one hand it's commendable that Google makes it hard on malicious actors, but on the other there are legitimate use cases for importing your own root CAs and using something stronger than WEP is just one of them.

hackmiester 4y ago
This is seriously such a joke because for years Android had a “don’t check certificate” option for 802.1X. It was unique among the most popular client OSes in allowing this extremely unsafe configuration, which is way worse than “trust on first use” (the least secure option in iOS). And now suddenly a total 180, they are extremely anal about certificates to the point that 802.1X is very hard to use. Thanks a lot gang.
- jeroenhd 4y ago
  My university used to recommend explicitly selecting "do not validate" for the longest time, even though validation through the system store (or a certificate of your choice) has existed for years. For what it's worth, if you're using a valid TLS certificate for your 802.1x setup then you don't need to load any certificates anymore (at least not since Android 10 or 11). Users may need to enter a domain to validate, though; I don't know the specifics of these protocols.
  - Avamander 4y ago
    It's unfortunate that the SSID can't be automatically used as the domain on the TLS certificate.
    - hackmiester 4y ago

Szpadel 4y ago

that's super anoying, as of some time you do not see cors requests in dev tools and basically only way to debug those issues was to use mitmproxy, and that's now also unnecessary complicated There is also env SSLKEYLOGFILE, that you can use on connection with Wireshark, but I didn't tested that yet with chrome I understand why it's nice from security point of view, but adding option to disable those in chrome://flags would be much better way

xg15 4y ago
> I understand why it's nice from security point of view With no way to disable this, it seems more about the security of the apps than about the security of the user.

bitwize 4y ago

But how will zScaler provide extra security for your corporate apps on Android now?

verifex 4y ago
Jailbroken androids for the enterprise! What could possibly go wrong?

NovemberWhiskey 4y ago

Isn't there an enterprise policy for disabling CT for certain CAs in Chrome?

Melatonic 4y ago
I believe there is for desktop but I am not sure on mobile. and I am not entirely sure if (without the browser enrolled) it would even be possible for the end user to control this.

new_user_final 4y ago

This and side-loaded accessibility threads are making me rethink how stupid people are. Please read and try to understand before typing something on your keyboard that will make you look like a stupid.

xg15 4y ago

I was kind of believing that most apps would use certificate pinning anyway, so I was kinda surprised manipulating the system store is actually workable. Though if modifying the system store is indeed officially "unsupported" my guess is it's only a matter of time before CT is enforced by the standard Android TLS API and will apply to apps as well. In which case I guess the next step would be... Add a fake CT log in addition to the fake root CA? But anyway, stuff like this confirms my impression that Android sides with app developers more than it sides with users when it comes to analysing traffic of your own devices.

nokya 4y ago
Certificate pinning is a big problem for corporate environments: large companies install CA certificates in their endpoints to allow centralized traffic inspection. Apps that enforce certificate pining cannot operate properly in these networks. It can be a desired function sometimes (e.g., a bank that wants to protect its customers) but in most situations it comes back at their face (i.e., bank customer wants to manage his bank account from his work office). About your conclusion, I fully agree with you. It is not about protecting users but about protecting Google. Let's not ignore the other fact that Chrome started hiding some requests from its Network panel (e.g., CORS) for "our own good", which makes network-layer inspection even more necessary.

mhils 4y ago

Enforcing CT is good, but that doesn't excuse the treatment of user-added CAs. On all platforms but Android, user-added CAs are considered particularly trustworthy. For example, Chrome Desktop, Firefox, and IE did not enforce HPKP if they encountered a cert from a user-added CA. Why does Android do the opposite? I don't see the threat model they are addressing. We (mitmproxy) have repeatedly tried to get an answer to this from the Android folks (e.g. here: https://github.com/mitmproxy/mitmproxy/issues/2054#issuecomment-282585162 https://github.com/mitmproxy/mitmproxy/issues/2054#issuecomm...). It very much feels like they just want to kill uncomfortable privacy research.

midasuni 4y ago
I want to add a user ÇA but only for a certain sites. If I’m developing on blah.com, I’m happy to add a root certificate, but I want to choose what sites (blah.com, blah.de, etc) I trust that very to accept, I don’t want it doing bank.com because I don’t trust my own CA management to be infallible. Name constraints are poorly supported, and even then that again relies on me creating the root cert correctly. Browsers seem to give me the user the choice of either accepting the cert fully or not accepting it, not giving me the control. Why is that.
- smw 4y ago
  Yes! Thank you! So many use cases!
heavyset_go 4y ago
You're right on the money, and they don't want people reversing APIs, either.
- aliswe 4y ago
  who doesn't want you reversing their apis, Google? Oh ..
no_time 4y ago
>For example, Chrome Desktop, Firefox, and IE did not enforce HPKP if they encountered a cert from a user-added CA. They have no teeth on these platforms (as of now). Contrary to this, Android has been engineered from the ground up to make it's inner workings as opaque and unflexible as possible.

1vuio0pswjnm7 4y ago

"Browsers receiving this traffic enforce that all certificates they receive come with a matching SCT, signed by a log provider they trust." Interesting the word is "they" and not "you". Assuming "they" means the "tech" companies that provide these browsers and "you" means the computer owner. Computer owners are usually given the run-time option to remove "trusted" root certificates that are pre-installed with browsers like Chrome. That is, remove them from the current list of trusted root certificates, not remove them from the source code. In a more perfect world, more computer owners could compile their own browsers,[FN1] thereby giving them the opportunity (freedom of choice) to remove untrusted certificates from the source code, as well as to add their own. Not to mention make other useful changes suitable to their own needs. Can the computer owner remove a "trusted" log provider. Can the computer owner add their own log provider. FN1. I prefer to rely on a localhost proxy to perform TLS instead of the browser. One benefit is that I can read, edit and compile the proxy source code myself, quickly and easily. Unlike the graphical browser from the online ad services "tech" company, the author(s) of the proxy are not compromised by a pecuniary interest in selling and delivering programmatic advertising services, and the ability to use an in-house browser to support that pernicious endeavour. In using a proxy, I am not having to fight against the interests of the paternalistic browser vendor in order to protect my own.

y4mi 4y ago
> I prefer to rely on a proxy to perform TLS instead of the browser. That's one step forward and about 30 steps backwards if you're actually doing that for security. Proxies silently accept broken TLS configuration all the time and serve then to you as https secured. You're unlikely to encounter invalid https configurations nowadays, so you likely won't ever notice, but it's definitely less secure to break the TLS connection in the proxy
- zzo38computer 4y ago
  > Proxies silently accept broken TLS configuration all the time I don't want the browser to enforce TLS configuration; the proxy could be configurable to set it how I want it to accept or not accept broken TLS configurations.

Animats 4y ago

"HTTP Toolkit gives you one-click HTTP(S) interception, inspection & mocking for any Android app." There's kind of a vested interest here. It would probably be sufficient to allow cert bypass in a desktop Android phone emulator, such as Android Studio. That's intended for debug and test. Nobody uses that for non-debug use by mistake.

Anunayj 4y ago

Can I simply not choose the CT log I want to use and host my own CT log with my certs in there? If I can't doesn't this mean this effectively makes it so my cert has to be in Google's CT logs to be valid.

lokar 4y ago

The flag he mentions seems like a reasonable way to support the debugging use case. It's more to setup, but people doing this should already be using automation to install the cert, etc.

1vuio0pswjnm7 4y ago

An issue not mentioned in this is that at the office it is routine to MITM TLS connections, what some call "TLS inspection".[FN1] There are important reasons for performing TLS inspection aside from "developers testing their smartphone app" or "security research". An employer should want to see the contents of what is traversing the employer's network. The employer owns the network so she gets to decide. A home computer user should want to see the contents of what is traversing the home computer user's network. The home computer user owns the network so she gets to decide. Anything, apps from "tech" companies, that interferes with the ability of the network owner to see the contents of that traffic is a threat. FN1. https://security.stackexchange.com/questions/107542/is-it-common-practice-for-companies-to-mitm-https-traffic https://security.stackexchange.com/questions/107542/is-it-co... https://fak3r.com/2015/07/22/your-employer-runs-ssl-mitm-attacks-on-you/ https://fak3r.com/2015/07/22/your-employer-runs-ssl-mitm-att... https://www.quora.com/Why-are-companies-trying-to-inspect-SSL-TLS-traffic-of-their-employees https://www.quora.com/Why-are-companies-trying-to-inspect-SS... https://it.slashdot.org/story/14/03/05/1724237/ask-slashdot-does-your-employer-perform-https-mitm-attacks-on-employees https://it.slashdot.org/story/14/03/05/1724237/ask-slashdot-... https://www.schneier.com/blog/archives/2019/11/the_nsa_warns_o.html https://www.schneier.com/blog/archives/2019/11/the_nsa_warns... https://attack.mitre.org/mitigations/M1020/ https://attack.mitre.org/mitigations/M1020/

josephcsible 4y ago
Are you okay if your ISP starts MITM'ing all of your TLS traffic, since they own the network you're connecting to?
- 1vuio0pswjnm7 4y ago
  Who owns the data.