2 ms·

Sooo... the news here is that Apple's caching framework works and apps that don't care about connecting to the right remote service (aka apps that don't use SSL

Sooo... the news here is that Apple's caching framework works and apps that don't care about connecting to the right remote service (aka apps that don't use SSL) can be hijacked with MITM. This is ... news? I mean, I'd love to see more apps capable not only of SSL but certificate pinning, binary data transfer, and more. Besides we all know in-app communication is low-hanging fruit for security researchers, even with otherwise secure apps. Twitter's hard-coded OAuth token with unlimited usage comes to mind, for example. It's not that the apps themselves aren't "secure enough" but that once you remove the restrictive nature of the browser as sandbox with an exposed address bar, apps can get up to some funny business seemingly out of sight. A useful reminder, to be sure, but it must be a slow news day for this to get so many up votes.

lstamour 13y ago
I am reminded also of Siri hacks from 2011: http://hackaday.com/2011/11/21/siri-proxy-adds-tons-of-functionality-doesnt-require-a-jailbreak/ http://hackaday.com/2011/11/21/siri-proxy-adds-tons-of-funct... Oh and the original article mentions creating a certificate profile to install a custom SSL cert. That same technique can be used to MITM Apple's own iMessage system, since iMessage doesn't use certificate pinning: http://www.tripwire.com/state-of-security/top-security-stories/apple-imessage-vulnerable-eavesdropping-mitm-attacks/ http://www.tripwire.com/state-of-security/top-security-stori... Though the more "iPhone security vulnerability" stories you hear, it just comes down to fundamental principles. I'd be more worried from a security perspective that jailbreakers still say iOS 7.0.3 is vulnerable.
- jevinskie 13y ago
  Really interesting that iMessage doesn't use certificate pinning. Try as I might, I was unable to MITM iTunes store connections thanks to certificate pinning.
  - lstamour 13y ago
    Yes, I tried to use Charles Web Proxy to achieve a similar MITMing and was unable to. Good job with the credit card data, Apple! :)
cookingrobot 13y ago
This isn't just a useful reminder of a best practice - it's a study that says approx half of apps aren't doing it properly and are vulnerable. Let's get this news out.

lstamour 13y ago

I am reminded also of Siri hacks from 2011: http://hackaday.com/2011/11/21/siri-proxy-adds-tons-of-functionality-doesnt-require-a-jailbreak/ http://hackaday.com/2011/11/21/siri-proxy-adds-tons-of-funct... Oh and the original article mentions creating a certificate profile to install a custom SSL cert. That same technique can be used to MITM Apple's own iMessage system, since iMessage doesn't use certificate pinning: http://www.tripwire.com/state-of-security/top-security-stories/apple-imessage-vulnerable-eavesdropping-mitm-attacks/ http://www.tripwire.com/state-of-security/top-security-stori... Though the more "iPhone security vulnerability" stories you hear, it just comes down to fundamental principles. I'd be more worried from a security perspective that jailbreakers still say iOS 7.0.3 is vulnerable.

jevinskie 13y ago
Really interesting that iMessage doesn't use certificate pinning. Try as I might, I was unable to MITM iTunes store connections thanks to certificate pinning.
- lstamour 13y ago
  Yes, I tried to use Charles Web Proxy to achieve a similar MITMing and was unable to. Good job with the credit card data, Apple! :)

cookingrobot 13y ago

This isn't just a useful reminder of a best practice - it's a study that says approx half of apps aren't doing it properly and are vulnerable. Let's get this news out.