3 ms·
I am reminded also of Siri hacks from 2011: http://hackaday.com/2011/11/21/siri-proxy-adds-tons-of-functionality-doesnt-require-a-jailbreak/ http://hackaday.com
by lstamour 13y ago
I am reminded also of Siri hacks from 2011: http://hackaday.com/2011/11/21/siri-proxy-adds-tons-of-functionality-doesnt-require-a-jailbreak/ http://hackaday.com/2011/11/21/siri-proxy-adds-tons-of-funct...
Oh and the original article mentions creating a certificate profile to install a custom SSL cert. That same technique can be used to MITM Apple's own iMessage system, since iMessage doesn't use certificate pinning: http://www.tripwire.com/state-of-security/top-security-stories/apple-imessage-vulnerable-eavesdropping-mitm-attacks/ http://www.tripwire.com/state-of-security/top-security-stori...
Though the more "iPhone security vulnerability" stories you hear, it just comes down to fundamental principles. I'd be more worried from a security perspective that jailbreakers still say iOS 7.0.3 is vulnerable.
- jevinskie 13y agoReally interesting that iMessage doesn't use certificate pinning. Try as I might, I was unable to MITM iTunes store connections thanks to certificate pinning.
- lstamour 13y agoYes, I tried to use Charles Web Proxy to achieve a similar MITMing and was unable to. Good job with the credit card data, Apple! :)