3 ms·

> I discovered that putting a man-in-the-middle proxy between my Apple TV and the world lets me decrypt HTTPS traffic This surprised me quite a bit because nor

> I discovered that putting a man-in-the-middle proxy between my Apple TV and the world lets me decrypt HTTPS traffic This surprised me quite a bit because normally that shouldn't work, but then that surprise was exchanged for a different one, when I learned later down that you can add CAs to the certificate store of an Apple TV. Nice and thorough writeup, thanks for sharing. A good carousel through the entire stack involved.

windhaven 2y ago
If I had to guess why Apple supports adding certificates, it’s probably to allow Apple TVs to work as AirPlay boxes in corporate/educational environments while playing nice with the IT/device management stuff that entails. For instance, when I was in college, getting something on the college WiFi either required allow-listing it’s MAC address or installing a certificate.
- madeofpalk 2y ago
  This, and the fact that a fair bit of this would 'come for free' due to tvOS being based on iOS which has supported custom CAs for ages.
codemusings 2y ago
> [...] when I learned later down that you can add CAs to the certificate store of an Apple TV. Same. I would not have guessed that that's possible but I guess I never tried to access a resource without a valid certificate chain on Apple TV.
jisnsm 2y ago
Most devices allow you to add CAs, but almost all apps nowadays use certificate pinning which means the system certificate store is ignored. I find it extremely surprising that YouTube doesn’t do that.
- mschuster91 2y ago
  > I find it extremely surprising that YouTube doesn’t do that. Not surprising for me - it used to be only banks where it was required (sometimes by law) that any and all communication be intercepted and logged, but this crap (that by definition breaks certificate pinning) is now getting rolled out to even small businesses as part of some cyber-insurance-mandated endpoint/whatever security solution. And Youtube is obviously of the opinion that while bankers aren't enough of a target market to annoy with certificate pinning breaking their background music, ordinary F500 employees are a significant enough target market.
- AnonHP 2y ago
  > but almost all apps nowadays use certificate pinning which means the system certificate store is ignored Certificate pinning (or rather, public key pinning) is technically obsolete and browsers themselves removed support for it in 2018. [1] Are there many apps still really using this? [1]: https://en.m.wikipedia.org/wiki/HTTP_Public_Key_Pinning https://en.m.wikipedia.org/wiki/HTTP_Public_Key_Pinning
  - klausa 2y ago
    Mobile apps still frequently do, yes. It's gotten less popular over the years as people keep asking "wait, what are we doing this for again?"; but it's still very popular in certain kinds of apps (anything banking related will almost certainly have it, along with easily broken and bypassed jailbreak detections, etc).
  - solarexplorer 2y ago
    I don't have any numbers, but I think this is still pretty common. On iOS for example Alamofire which is a popular network stack, still offers this as a feature. I think the use case is a bit different for apps and web sites, especially for closed ecosystems like Apple's where reverse engineering is not as easy/straightforward. https://github.com/Alamofire/Alamofire https://github.com/Alamofire/Alamofire
  - oarsinsync 2y ago
    Most personal banking apps I’ve used still do this. The bank is liable for your lost funds if your corporate IT department doesn’t secure the MITM solution properly otherwise. (The end customer isn’t liable for the bank’s inability to properly secure their app from MITM attacks…)
josephg 2y ago
Unfortunately Google can trivially block this by checking which CA signed their SSL certificate in the YouTube app. I don’t know if they will - doing so might break YouTube within a lot of corporate environments. But it would be unfortunately easy.
- pbasista 2y ago
  Of course Google can do this. And more. They could, if they wanted, to embed ads into the video stream itself with no way to distinguish them from the actual video content. But they do not do it. They had so much time and opportunities to do that over the years. And yet, they did not do it. I am not going to speculate why. But I suppose it is safe to assume that it is their intention to not do it.
  - ryao 2y ago
    Does anyone do that? The average developer likely would not think to do this because it is too computationally intensive to splice things into A/V streams on the fly. A more clever developer could splice the ad into the video at an I frame, but then the ad needs to be a multiple of the number of frames that are both the I frame and follow the I frame. This also would mess with metadata on the length of the video that would need to be adjusted in advance. It is doable, but you give up flexibility and your HTTP sessions cease to be stateless. Then there is the need to handle splicing into audio and I do not know offhand if there is a cheap way of doing that at the server like you can do with video through I frame splicing. It seems to me that they have lower server costs by doing things the current way.
    - DrFalkyn 2y ago
      YouTube Videos are a stream, not a file you download. I’m not sure what the major technical nurdle is injecting ads directly into the stream. Also H.264 has key frames typically a few sounds apart anyway
    - wingworks 2y ago
      I think twitch embeds their ads. To block there ads you now need to pretend to be in one of the ad-free countries.
mzajc 2y ago
Ironically enough Android TV (at least version 7.X) does not let you do that, which I found out the hard way when trying to work around untrusted Let's Encrypt certificates.
- jeroenhd 2y ago
  Starting with Android 7, apps have to opt into user-installed certificates. Browsers often do (Firefox is an annoying exception, you need to turn it on in the dev settings and it doesn't work in the official release version of the browser), but apps usually don't even know that the setting exists. Aside from that, Android has a very easy certificate pinning API where you can just assign a fingerprint to a domain name in the XML config files and it'll pin a certificate to that domain. Easy to bypass if you modify the APK file, but then you miss out on updates and other mechanisms could check if the signature has been tampered with. With root access (shouldn't be too hard to gain on an Android device still running 7) you can add your certificate to the root certificate folder on the system partition. This will make Let's Encrypt work on all apps. It doesn't bypass certificate pinning, of course, but you don't need there for Let's Encrypt.
ryao 2y ago
I remember people promising a rogue CA would not work anymore due to certificate transparency requiring certificates to be published in order to be valid, but it is quite obvious here that certificate transparency was not even needed. A private CA is different from a rogue CA, but if the private CA was not forced to do certificate transparency, I wonder what is supposedly forcing the public CAs to do it for their certificates to be “valid”.
- vlovich123 2y ago
  > I wonder what is supposedly forcing the public CAs to do it for their certificates to be “valid”. The power of browsers and operating systems including the cert in the default store distributed to everyone. Participating in cert transparency is a requirement.
  - ryao 2y ago
    How is that enforced as it was billed as certificates are not valid unless published, yet it is obvious certificates for a private CA are not being published and are treated as valid?
    - vlovich123 2y ago
      As I understand it there are various interested parties who monitor to make sure that the default CAs in the root store publish to the certificate transparency before they sign anything. A violation would be grounds for immediate removal. None of this applies to a private CA you add to your own store.

windhaven 2y ago

If I had to guess why Apple supports adding certificates, it’s probably to allow Apple TVs to work as AirPlay boxes in corporate/educational environments while playing nice with the IT/device management stuff that entails. For instance, when I was in college, getting something on the college WiFi either required allow-listing it’s MAC address or installing a certificate.

madeofpalk 2y ago
This, and the fact that a fair bit of this would 'come for free' due to tvOS being based on iOS which has supported custom CAs for ages.

codemusings 2y ago

> [...] when I learned later down that you can add CAs to the certificate store of an Apple TV. Same. I would not have guessed that that's possible but I guess I never tried to access a resource without a valid certificate chain on Apple TV.

jisnsm 2y ago

Most devices allow you to add CAs, but almost all apps nowadays use certificate pinning which means the system certificate store is ignored. I find it extremely surprising that YouTube doesn’t do that.

mschuster91 2y ago
> I find it extremely surprising that YouTube doesn’t do that. Not surprising for me - it used to be only banks where it was required (sometimes by law) that any and all communication be intercepted and logged, but this crap (that by definition breaks certificate pinning) is now getting rolled out to even small businesses as part of some cyber-insurance-mandated endpoint/whatever security solution. And Youtube is obviously of the opinion that while bankers aren't enough of a target market to annoy with certificate pinning breaking their background music, ordinary F500 employees are a significant enough target market.
AnonHP 2y ago
> but almost all apps nowadays use certificate pinning which means the system certificate store is ignored Certificate pinning (or rather, public key pinning) is technically obsolete and browsers themselves removed support for it in 2018. [1] Are there many apps still really using this? [1]: https://en.m.wikipedia.org/wiki/HTTP_Public_Key_Pinning https://en.m.wikipedia.org/wiki/HTTP_Public_Key_Pinning
- klausa 2y ago
  Mobile apps still frequently do, yes. It's gotten less popular over the years as people keep asking "wait, what are we doing this for again?"; but it's still very popular in certain kinds of apps (anything banking related will almost certainly have it, along with easily broken and bypassed jailbreak detections, etc).
- solarexplorer 2y ago
  I don't have any numbers, but I think this is still pretty common. On iOS for example Alamofire which is a popular network stack, still offers this as a feature. I think the use case is a bit different for apps and web sites, especially for closed ecosystems like Apple's where reverse engineering is not as easy/straightforward. https://github.com/Alamofire/Alamofire https://github.com/Alamofire/Alamofire
- oarsinsync 2y ago
  Most personal banking apps I’ve used still do this. The bank is liable for your lost funds if your corporate IT department doesn’t secure the MITM solution properly otherwise. (The end customer isn’t liable for the bank’s inability to properly secure their app from MITM attacks…)

josephg 2y ago

Unfortunately Google can trivially block this by checking which CA signed their SSL certificate in the YouTube app. I don’t know if they will - doing so might break YouTube within a lot of corporate environments. But it would be unfortunately easy.

pbasista 2y ago
Of course Google can do this. And more. They could, if they wanted, to embed ads into the video stream itself with no way to distinguish them from the actual video content. But they do not do it. They had so much time and opportunities to do that over the years. And yet, they did not do it. I am not going to speculate why. But I suppose it is safe to assume that it is their intention to not do it.
- ryao 2y ago
  Does anyone do that? The average developer likely would not think to do this because it is too computationally intensive to splice things into A/V streams on the fly. A more clever developer could splice the ad into the video at an I frame, but then the ad needs to be a multiple of the number of frames that are both the I frame and follow the I frame. This also would mess with metadata on the length of the video that would need to be adjusted in advance. It is doable, but you give up flexibility and your HTTP sessions cease to be stateless. Then there is the need to handle splicing into audio and I do not know offhand if there is a cheap way of doing that at the server like you can do with video through I frame splicing. It seems to me that they have lower server costs by doing things the current way.
  - DrFalkyn 2y ago
    YouTube Videos are a stream, not a file you download. I’m not sure what the major technical nurdle is injecting ads directly into the stream. Also H.264 has key frames typically a few sounds apart anyway
  - wingworks 2y ago
    I think twitch embeds their ads. To block there ads you now need to pretend to be in one of the ad-free countries.

mzajc 2y ago

Ironically enough Android TV (at least version 7.X) does not let you do that, which I found out the hard way when trying to work around untrusted Let's Encrypt certificates.

jeroenhd 2y ago
Starting with Android 7, apps have to opt into user-installed certificates. Browsers often do (Firefox is an annoying exception, you need to turn it on in the dev settings and it doesn't work in the official release version of the browser), but apps usually don't even know that the setting exists. Aside from that, Android has a very easy certificate pinning API where you can just assign a fingerprint to a domain name in the XML config files and it'll pin a certificate to that domain. Easy to bypass if you modify the APK file, but then you miss out on updates and other mechanisms could check if the signature has been tampered with. With root access (shouldn't be too hard to gain on an Android device still running 7) you can add your certificate to the root certificate folder on the system partition. This will make Let's Encrypt work on all apps. It doesn't bypass certificate pinning, of course, but you don't need there for Let's Encrypt.

ryao 2y ago

I remember people promising a rogue CA would not work anymore due to certificate transparency requiring certificates to be published in order to be valid, but it is quite obvious here that certificate transparency was not even needed. A private CA is different from a rogue CA, but if the private CA was not forced to do certificate transparency, I wonder what is supposedly forcing the public CAs to do it for their certificates to be “valid”.

vlovich123 2y ago
> I wonder what is supposedly forcing the public CAs to do it for their certificates to be “valid”. The power of browsers and operating systems including the cert in the default store distributed to everyone. Participating in cert transparency is a requirement.
- ryao 2y ago
  How is that enforced as it was billed as certificates are not valid unless published, yet it is obvious certificates for a private CA are not being published and are treated as valid?
  - vlovich123 2y ago
    As I understand it there are various interested parties who monitor to make sure that the default CAs in the root store publish to the certificate transparency before they sign anything. A violation would be grounds for immediate removal. None of this applies to a private CA you add to your own store.