4 ms·
Noob question, but was the application streaming over plain http, or did you do something to decrypt https traffic? How would you do the latter? Edit: with mit
by yazzku 3y ago
Noob question, but was the application streaming over plain http, or did you do something to decrypt https traffic? How would you do the latter?
Edit: with mitmproxy and installing a cert in the phone's store, as explained in the latter half of the write-up. I guess that wouldn't work if the application pinned the server certs, but I guess this "commercial malware" is not that sophisticated.
- x1sec 3y agoIn the second part of the blog post series, I show that they AMap SDK they use encrypts data data first using AES and then further encrypting the AES key(s) with a public RSA key embedded in the application. Not trivial. If certificate pinning was used, it can be bypassed by modifying the APK or dynamically hooking into the running application using Frida. Often you have to try a few things before getting it working, often starting with a universal TLS bypass Frida script [1][2] [1] https://codeshare.frida.re/@pcipolloni/universal-android-ssl-pinning-bypass-with-frida/ https://codeshare.frida.re/@pcipolloni/universal-android-ssl... [2] https://codeshare.frida.re/@akabe1/frida-multiple-unpinning/ https://codeshare.frida.re/@akabe1/frida-multiple-unpinning/