4 ms·

Surely there is a way of checking api calls made by an app and blocking those? I have never looked into this mind

tuukkah 3y ago
HTTPS means the network connections between the app and the backend are opaque to third parties including the user. Certificate pinning means you cannot insert yourself as the backend and/or MITM the requests. The app will only communicate directly with the owner of the private key it was pinned to. Depending on the app and OS, it may be more or less easy to change the app to remove/crack the pinning. In general, if you are not in full control of the device (root), it's not possible.
- blibble 3y ago
  for android you pull down the apk using adb, patch maybe 1 byte in it and push it back very very easy, no root required
  - exhilaration 3y ago
    I'd love to read a tutorial or watch a video going over the patch process -- can you share any links?
  - tuukkah 3y ago
    I wouldn't call patching a binary very easy, especially since our point of reference was installing an ad blocker extension in the browser. Also, it takes more than one byte if the binary is obfuscated and full of various ways to check that it hasn't been tampered with.
    - deleted 3y ago
      [deleted]
    - blibble 3y ago
      > I wouldn't call patching a binary very easy it's even easier than that as all apps (except native ones) will be using the java TrustManager interface > Also, it takes more than one byte if the binary is obfuscated but they can't hide the calls into TrustManager a small utility could automatically take in the APK, patch out the calls and return the fixed APK for you (would probably work for 99% of apps out of the box)
      - freedomben 3y ago
        > it's even easier than that as all apps (except native ones) will be using the java TrustManager interface Is this required? i.e. do all apps have to use the TrustManager interface to accomplish cert pinning, or is that merely the official way?
        blibble 3y ago
        > Is this required? well, Java is Turing complete, so you could completely re-implement TLS yourself instead of using the API that comes with the platform in practice no-one is going to do that
- Izkata 3y ago
  > HTTPS means the network connections between the app and the backend are opaque to third parties including the user. It means the payload is. HTTPS alone doesn't have any special considerations for hiding the domain, which I think is visible so the request can be routed correctly. And since a lot of ad-blocking is based on domain, that ought to work.
  - freedomben 3y ago
    You're not wrong, but ads are already moving to a different model with either first-party URLs or random ones that are difficult or impossible to enumerate to get around ad blocking. With Apple's new thing that's going to bring the reckoning even sooner (sigh). This technique is much harder and won't last very long I'm afraid.

HTTPS means the network connections between the app and the backend are opaque to third parties including the user. Certificate pinning means you cannot insert yourself as the backend and/or MITM the requests. The app will only communicate directly with the owner of the private key it was pinned to. Depending on the app and OS, it may be more or less easy to change the app to remove/crack the pinning. In general, if you are not in full control of the device (root), it's not possible.

blibble 3y ago
for android you pull down the apk using adb, patch maybe 1 byte in it and push it back very very easy, no root required
- exhilaration 3y ago
  I'd love to read a tutorial or watch a video going over the patch process -- can you share any links?
- tuukkah 3y ago
  I wouldn't call patching a binary very easy, especially since our point of reference was installing an ad blocker extension in the browser. Also, it takes more than one byte if the binary is obfuscated and full of various ways to check that it hasn't been tampered with.
  - deleted 3y ago
    [deleted]
  - blibble 3y ago
    > I wouldn't call patching a binary very easy it's even easier than that as all apps (except native ones) will be using the java TrustManager interface > Also, it takes more than one byte if the binary is obfuscated but they can't hide the calls into TrustManager a small utility could automatically take in the APK, patch out the calls and return the fixed APK for you (would probably work for 99% of apps out of the box)
    - freedomben 3y ago
      > it's even easier than that as all apps (except native ones) will be using the java TrustManager interface Is this required? i.e. do all apps have to use the TrustManager interface to accomplish cert pinning, or is that merely the official way?
      - blibble 3y ago
        > Is this required? well, Java is Turing complete, so you could completely re-implement TLS yourself instead of using the API that comes with the platform in practice no-one is going to do that
Izkata 3y ago
> HTTPS means the network connections between the app and the backend are opaque to third parties including the user. It means the payload is. HTTPS alone doesn't have any special considerations for hiding the domain, which I think is visible so the request can be routed correctly. And since a lot of ad-blocking is based on domain, that ought to work.
- freedomben 3y ago
  You're not wrong, but ads are already moving to a different model with either first-party URLs or random ones that are difficult or impossible to enumerate to get around ad blocking. With Apple's new thing that's going to bring the reckoning even sooner (sigh). This technique is much harder and won't last very long I'm afraid.