3 ms·

Certificate pinning should be pretty easy to solve in this particular case: just get a proxy/VPN! The Faraday cage shenanigans are pretty cool though.

nimih 2y ago
You might need to explain how a VPN solves the certificate pinning issue; the author is already modifying the phone's HTTP/S traffic via a proxied network connection, and a VPN doesn't (to my knowledge) allow you to forge valid HTTPS responses using the pinned server certificate.
- notpushkin 2y ago
  Sorry, should have clarified: instead of faking the response, you can connect to Apple’s servers through a US proxy. They will see you have a US IP address and return the corresponding location code, all over properly signed HTTPS. There are a few caveats (e.g. using a residential or mobile proxy would look less suspicious, in case Apple looks out for datacenter IP ranges), but I think it should work.
  - NavinF 2y ago
    He tried that. The phone knows its location using GPS and wifi. Apple doesn't care about your IP
- tim-- 2y ago
  You don't need to modify the HTTPS traffic. You get a VPS that is in the US, and set the device up so that when it requests the domain (gspe1-ssl.ls.apple.com) that the IP address returned is not an Apple IP address, but the VPS IP. The VPS simply forwards traffic on port 443 to gspe1-ssl.ls.apple.com.
  - dmcc365 2y ago
    Have you seen success with this method?
rty32 2y ago
Eh, how does using a VPN make it easier to MITM attack yourself and modify the response of that GET request?
- notpushkin 2y ago
  Sorry, should have made it more clear! Basically there’s no need to MITM at all here: https://news.ycombinator.com/item?id=42122270 https://news.ycombinator.com/item?id=42122270
thel3l 2y ago
That's exactly what we did in the end—used a commercial VPN and provided internet to the device over the USB cable. Could have probably used a Tailscale on a VPS somewhere too.
- mkagenius 2y ago
  What he meant to say is, all your efforts were of no use, just use VPN in the ipad and the location will change. But I suppose, in this case Apple is deliberately using the wifi signals, not relying on IP so "just use VPN" doesn't work.

nimih 2y ago

You might need to explain how a VPN solves the certificate pinning issue; the author is already modifying the phone's HTTP/S traffic via a proxied network connection, and a VPN doesn't (to my knowledge) allow you to forge valid HTTPS responses using the pinned server certificate.

notpushkin 2y ago
Sorry, should have clarified: instead of faking the response, you can connect to Apple’s servers through a US proxy. They will see you have a US IP address and return the corresponding location code, all over properly signed HTTPS. There are a few caveats (e.g. using a residential or mobile proxy would look less suspicious, in case Apple looks out for datacenter IP ranges), but I think it should work.
- NavinF 2y ago
  He tried that. The phone knows its location using GPS and wifi. Apple doesn't care about your IP
tim-- 2y ago
You don't need to modify the HTTPS traffic. You get a VPS that is in the US, and set the device up so that when it requests the domain (gspe1-ssl.ls.apple.com) that the IP address returned is not an Apple IP address, but the VPS IP. The VPS simply forwards traffic on port 443 to gspe1-ssl.ls.apple.com.
- dmcc365 2y ago
  Have you seen success with this method?

rty32 2y ago

Eh, how does using a VPN make it easier to MITM attack yourself and modify the response of that GET request?

notpushkin 2y ago
Sorry, should have made it more clear! Basically there’s no need to MITM at all here: https://news.ycombinator.com/item?id=42122270 https://news.ycombinator.com/item?id=42122270

thel3l 2y ago

That's exactly what we did in the end—used a commercial VPN and provided internet to the device over the USB cable. Could have probably used a Tailscale on a VPS somewhere too.

mkagenius 2y ago
What he meant to say is, all your efforts were of no use, just use VPN in the ipad and the location will change. But I suppose, in this case Apple is deliberately using the wifi signals, not relying on IP so "just use VPN" doesn't work.