4 ms·

What is the use case for this? Learning more about how Android apps communicate with their home server?

by cpach 2y ago

jcrawfordor 2y ago
Very useful for reverse engineering and security auditing of internal APIs. Particularly on Android a lot of apps pin CA certs or use their own trust store, so you have to do a little RE on them to insert your own cert... Or do it this way.
- mschuster91 2y ago
  Unfortunately that requires root, and SDKs have gotten incredibly good at detecting root - not to mention SafetyNet Attestation. For a full bypass of that crap, you nowadays need a lot of resources including a Secure Enclave exploit - for now they're (relatively) cheap but eventually they'll be the kind of stuff traded for seven figures a pop. Eternal shame on Google for not insisting that Android would follow the "PC model" of the user being root on their own machine and DRM and whatnot can go and screw themselves. They had the chance of actually delivering something that would not require jailbreaking and cat-and-mouse games like iOS, but they blew it (and blew the MAFIAA instead).
  - kelnos 2y ago
    > and DRM and whatnot can go and screw themselves The funny thing is that they wouldn't have even needed to take this position. DRM works well enough on (e.g.) Windows to make the various studios more or less happy, and users have "root" on Windows as usual. Ditto for macOS. Hell, DRM works just fine on my Linux desktop install, as much as I despite its existence.
    - XorNot 2y ago
      My favorite benefit of DRM support has been that Firefox will prompt me "do you want to allow DRM content?" when I visit a news website. Ignoring that or clicking no auto-blocks all the autoplaying videos.
      - freedomben 2y ago
        Indeed, I love this feature of Firefox. There's something that feels so damn good about saying "No" to DRM content. If only there was a way to tell the website that the content was blocked due to DRM...
      - lmm 2y ago
        The web is finally catching up with where it was in the Flash days.
  - PlutoIsAPlanet 2y ago
    > Eternal shame on Google for not insisting that Android would follow the "PC model" of the user being root on their own machine and DRM .. To be fair to Google, banks don't usually allow you to download and generate EMV tokens to perform card transactions on your PC, which places a different set of security requirements (legal requirements too) on Android phones for things like Google Pay to exist.
    - mschuster91 2y ago
      Yeah then make a Secure Enclave application for that. But ffs I am sick and tired of playing cat and mouse with every random app that whines about my phone being rooted. I might be less angry about that if there were a decent FULL backup solution for Android - with iOS I can do a backup and restore and almost everything will be restored, I think the sole exception is eSIM and Apple Pay because the secrets for that are in the SE. But for Android? Forget it, and there's enough games that don't even implement Google Play cloud-save integration. No way to backup these without root.
justahuman74 2y ago
Inspecting what apps are sending out when they don't want you to see
hawski 2y ago
Just today I thought about a hypothetical strace analog for web requests. Something that could trace all the HTTPS requests a program makes without playing around with certificates.
- xyzzy_plugh 2y ago
  You can already do this with eBPF.
deleted 2y ago
[deleted]
rocqua 2y ago
Interception for regulated companies. Banks have to keep a log of all communication between their employees. That requires HTTPS interception. Before TLS1.3 they would install root CAs on all company devices, have an edge proxy, and use SNI to determine whether an HTTPS session should be man in the middled. Because it would take way to much compute to MitM all trafic (like YouTube video). After TLS1.3 encrypted SNI blocks this. But they still need (and other companies want) to selectively intercept HTTPS. With a tool like this you can achieve that clientside, rather than at the network edge.
- new23d 2y ago
  TLS 1.3 and ESNI (now called Encrypted Client Hello - ECH) are separate standards, although you'll see ECH only enabled in bleeding edge stacks. In fact, ECH is still in IETF draft phase [1]. It can be disabled if an organisation wishes to. I wrote about how to do this in Chrome [2,3], and will write about Firefox when I get a chance. [1] https://datatracker.ietf.org/doc/draft-ietf-tls-esni/ https://datatracker.ietf.org/doc/draft-ietf-tls-esni/ [2] https://chasersystems.com/blog/disabling-encrypted-clienthello-in-google-chrome-and-why/ https://chasersystems.com/blog/disabling-encrypted-clienthel... [3] https://news.ycombinator.com/item?id=37823262 https://news.ycombinator.com/item?id=37823262
  - rocqua 2y ago
    Ah, i didn't know they actually moved eSNI out of TLS1.3. it was certainly part of quite a few drafts. I do find it sad it isn't pushed harder. Companies who need to do interception have legitimate concerns, but they can be addressed.
- jcelerier 2y ago
  In which country is this ? In France the law is pretty clear : > L’employeur ne peut pas mettre en place un dispositif d’écoute ou d’enregistrement permanent ou systématique, sauf texte légal (par exemple pour les services d’urgence). And there's afaik no such legal text for banks. Employees also have the right to privacy on their work-provided computer (e.g. to check their personal mails) so all those packet inspection and decryption things would be flat-out illegal there, thankfully

What is the use case for this? Learning more about how Android apps communicate with their home server?

by cpach 2y ago

What is the use case for this? Learning more about how Android apps communicate with their home server?

Very useful for reverse engineering and security auditing of internal APIs. Particularly on Android a lot of apps pin CA certs or use their own trust store, so you have to do a little RE on them to insert your own cert... Or do it this way.

mschuster91 2y ago
Unfortunately that requires root, and SDKs have gotten incredibly good at detecting root - not to mention SafetyNet Attestation. For a full bypass of that crap, you nowadays need a lot of resources including a Secure Enclave exploit - for now they're (relatively) cheap but eventually they'll be the kind of stuff traded for seven figures a pop. Eternal shame on Google for not insisting that Android would follow the "PC model" of the user being root on their own machine and DRM and whatnot can go and screw themselves. They had the chance of actually delivering something that would not require jailbreaking and cat-and-mouse games like iOS, but they blew it (and blew the MAFIAA instead).
- kelnos 2y ago
  > and DRM and whatnot can go and screw themselves The funny thing is that they wouldn't have even needed to take this position. DRM works well enough on (e.g.) Windows to make the various studios more or less happy, and users have "root" on Windows as usual. Ditto for macOS. Hell, DRM works just fine on my Linux desktop install, as much as I despite its existence.
  - XorNot 2y ago
    My favorite benefit of DRM support has been that Firefox will prompt me "do you want to allow DRM content?" when I visit a news website. Ignoring that or clicking no auto-blocks all the autoplaying videos.
    - freedomben 2y ago
      Indeed, I love this feature of Firefox. There's something that feels so damn good about saying "No" to DRM content. If only there was a way to tell the website that the content was blocked due to DRM...
    - lmm 2y ago
      The web is finally catching up with where it was in the Flash days.
- PlutoIsAPlanet 2y ago
  > Eternal shame on Google for not insisting that Android would follow the "PC model" of the user being root on their own machine and DRM .. To be fair to Google, banks don't usually allow you to download and generate EMV tokens to perform card transactions on your PC, which places a different set of security requirements (legal requirements too) on Android phones for things like Google Pay to exist.
  - mschuster91 2y ago
    Yeah then make a Secure Enclave application for that. But ffs I am sick and tired of playing cat and mouse with every random app that whines about my phone being rooted. I might be less angry about that if there were a decent FULL backup solution for Android - with iOS I can do a backup and restore and almost everything will be restored, I think the sole exception is eSIM and Apple Pay because the secrets for that are in the SE. But for Android? Forget it, and there's enough games that don't even implement Google Play cloud-save integration. No way to backup these without root.

justahuman74 2y ago

Inspecting what apps are sending out when they don't want you to see

hawski 2y ago

Just today I thought about a hypothetical strace analog for web requests. Something that could trace all the HTTPS requests a program makes without playing around with certificates.

xyzzy_plugh 2y ago
You can already do this with eBPF.

deleted 2y ago

[deleted]

rocqua 2y ago

Interception for regulated companies. Banks have to keep a log of all communication between their employees. That requires HTTPS interception. Before TLS1.3 they would install root CAs on all company devices, have an edge proxy, and use SNI to determine whether an HTTPS session should be man in the middled. Because it would take way to much compute to MitM all trafic (like YouTube video). After TLS1.3 encrypted SNI blocks this. But they still need (and other companies want) to selectively intercept HTTPS. With a tool like this you can achieve that clientside, rather than at the network edge.

new23d 2y ago
TLS 1.3 and ESNI (now called Encrypted Client Hello - ECH) are separate standards, although you'll see ECH only enabled in bleeding edge stacks. In fact, ECH is still in IETF draft phase [1]. It can be disabled if an organisation wishes to. I wrote about how to do this in Chrome [2,3], and will write about Firefox when I get a chance. [1] https://datatracker.ietf.org/doc/draft-ietf-tls-esni/ https://datatracker.ietf.org/doc/draft-ietf-tls-esni/ [2] https://chasersystems.com/blog/disabling-encrypted-clienthello-in-google-chrome-and-why/ https://chasersystems.com/blog/disabling-encrypted-clienthel... [3] https://news.ycombinator.com/item?id=37823262 https://news.ycombinator.com/item?id=37823262
- rocqua 2y ago
  Ah, i didn't know they actually moved eSNI out of TLS1.3. it was certainly part of quite a few drafts. I do find it sad it isn't pushed harder. Companies who need to do interception have legitimate concerns, but they can be addressed.
jcelerier 2y ago
In which country is this ? In France the law is pretty clear : > L’employeur ne peut pas mettre en place un dispositif d’écoute ou d’enregistrement permanent ou systématique, sauf texte légal (par exemple pour les services d’urgence). And there's afaik no such legal text for banks. Employees also have the right to privacy on their work-provided computer (e.g. to check their personal mails) so all those packet inspection and decryption things would be flat-out illegal there, thankfully