6 ms·
Very clever way of doing this (though I have a feeling you could probably enforce pinning even in sandboxed mode). I remember trying to MitM Snapchat back in co
by dvt 3y ago
Very clever way of doing this (though I have a feeling you could probably enforce pinning even in sandboxed mode). I remember trying to MitM Snapchat back in college and couldn't figure it out as they were also using cert pinning.
- 4death4 3y agoFundamentally, it’s hard to enforce certificate pinning if the user can modify the binary. Even if sandbox mode used certificate pinning, there would likely be some other way of removing the pinned cert checks.
- detourdog 3y agoThis is a large part of Apple's control/Secure Enclave decisions. These decisions can seem arbitrary and anti-completive from the outside.
- saagarjha 3y agoThis seems unrelated?
- detourdog 3y agoI saw is as related by an entities ability to control certificates on platforms with zero trust.
- saagarjha 3y agoApple designs the platform, though. Seems like a different model to me?
- detourdog 3y agoExactly I was pointing out why some may choose certain models. I would say that building a platform takes many considerations and the choices made led to this outcome. Apple made different choices and is often vilified for trying to maintain these protections. Apple has been slowly making progress of opening up their platform. The next 3 years will introduce a new landscape for apps. People will still be complaining.
- no_time 3y agoI wouldn't call it anti-competitive. Treacherous is a more apt description. https://www.gnu.org/philosophy/can-you-trust.html https://www.gnu.org/philosophy/can-you-trust.html
- detourdog 3y agoApple is a west coast company and they like their west coast BSD licenses.
- matheusmoreira 3y agoNot only anti-competitive but also treacherous. They exist to protect corporations from us, the users of the computers.
- dvt 3y ago> there would likely be some other way of removing the pinned cert checks Yes, but it's significantly harder than flipping a bit. There's also clever ways of countering this (e.g. checksumming the public key). Of course, even this is technically hackable, but extremely time-consuming in practice. Imagine getting the public key and adding a bunch (and by a bunch, I mean like 16k) of random ops throughout the control flow that crash the app if any random byte of the key is wrong. For extra fun, offset the byte by the instruction pointer. Good luck debugging that.
- Thaxll 3y agoIt prevents very basic RE / MITM.
- julkali 3y agoI tried the same thing, and while I managed to patch the application and intercept the requests, I gave up when trying to RE the shared object responsible for request signing. I couldn't even find the entry point. For a relatively small social media app they had insane security already back in 2015.
- ridafkih 3y agoSnapchat and TikTok both boast pretty gnarly RE-prevention measures.
- lwansbrough 3y agoFor the uninitiated: TikTok is known to send and receive telemetry packages through headers in other requests (IIRC), and employs the use of a virtual machine(!) to execute encrypted client code.
- weinzierl 3y agoAny source for that? What does "other" requests mean? Other than what? I doubt it could modify the headers of other apps.
- crtasm 3y agoRequests it makes for things required to function at all, video data etc. I guess? But this is the first time I've heard this claim.
- eddyg 3y agoSee https://www.nullpt.rs/reverse-engineering-tiktok-vm-1 https://www.nullpt.rs/reverse-engineering-tiktok-vm-1
- saagarjha 3y agoSnap has always had pretty beefy client security. Since, of course, a hacked client breaks the entire premise of their app.
- yieldcrv 3y agoamusing how many of us have tried this with mobile apps to be thwarted ….until now
- ridafkih 3y agoYou're right, it probably could have been implemented by only assigning the output of the sandbox flag function in the consumer function to true, but in this case it worked fine. :)