3 ms·

I really wish Charles generated a self-signed cert on installation, rather than using a root that you download from them. I suspect that a lot of people in the

by bri3d 12y ago

I really wish Charles generated a self-signed cert on installation, rather than using a root that you download from them. I suspect that a lot of people in the iOS dev community (where Charles seems ubiquitous) walk around with the Charles root on their phone, ripe for an easy malicious MITM against them. I'm also surprised more iOS and Android apps don't bundle and pin their certificates - it's still an obscurity measure since, worst comes to worst, the user can root / jailbreak the device and attach a debugger or watch the network stack, but it keeps any random user with Charles (or random malicious attacker with a stolen root cert) from reversing private APIs.

timrogers 12y ago
I agree. I'm glad people don't though, as I like de-privatising "private APIs" ;)
passfree 12y ago
You can use Proxy.app (http://www.websecurify.com/desktop/proxy.html http://www.websecurify.com/desktop/proxy.html) which does that. As for the certificate pinning - it makes proxying a very difficult.
beamatronic 12y ago
I believe Fiddler does this edit: Details on the process: http://blogs.telerik.com/fiddler/posts/13-08-19/faq---certificates-in-fiddler http://blogs.telerik.com/fiddler/posts/13-08-19/faq---certif... Relevant Quote: "Every Fiddler root certificate is uniquely generated, per user, per machine. No two Fiddler installations have the same root certificate. The only way for a Fiddler user to be “spoofed” by a bad guy is if that bad guy already is running code inside the user’s account (which means you’d already be pwned anyway)."
- bri3d 12y ago
  Every other product I can think of (Proxy.app, MITMproxy, and so on) also uses self-signed certificates generated at startup / configuration time rather than a shared root - I think that design is unique to Charles. Charles does allow you to use your own certificate, but it's not the default user flow. I see the ease-of-use case for the way Charles does it, but the shared-certificate approach is so insecure (you're basically handing the keys to all of your unpinned SSL traffic to anyone on the Internet) that I wish it would go away. I also really like Fiddler and the warnings it provides are excellent. Sadly, it doesn't really support OSX yet so many iOS developers can't use it.
  - voltagex_ 12y ago
    A very awkward way of using Fiddler from OS X would be via a Windows VM that had Fiddler set up to allow connections from other machines.
  - e28eta 12y ago
    I also found it hard to set up Charles to use a custom cert, definitely had to read the instructions on their site instead of trying to figure it out on my own.
fmela 12y ago
mitmproxy does this.
sprite 12y ago
Certificate pin bypass for Android: https://github.com/iSECPartners/Android-SSL-TrustKiller https://github.com/iSECPartners/Android-SSL-TrustKiller iOS: https://github.com/iSECPartners/ios-ssl-kill-switch https://github.com/iSECPartners/ios-ssl-kill-switch Sure it's a little bit extra work but not much. If someone is reversing your app chances are they are using a jailbroken device anyways to extract the unencrypted IPA or to attach gdb to your app.

by bri3d 12y ago

timrogers 12y ago

I agree. I'm glad people don't though, as I like de-privatising "private APIs" ;)

passfree 12y ago

You can use Proxy.app (http://www.websecurify.com/desktop/proxy.html http://www.websecurify.com/desktop/proxy.html) which does that. As for the certificate pinning - it makes proxying a very difficult.

beamatronic 12y ago

I believe Fiddler does this edit: Details on the process: http://blogs.telerik.com/fiddler/posts/13-08-19/faq---certificates-in-fiddler http://blogs.telerik.com/fiddler/posts/13-08-19/faq---certif... Relevant Quote: "Every Fiddler root certificate is uniquely generated, per user, per machine. No two Fiddler installations have the same root certificate. The only way for a Fiddler user to be “spoofed” by a bad guy is if that bad guy already is running code inside the user’s account (which means you’d already be pwned anyway)."

bri3d 12y ago
Every other product I can think of (Proxy.app, MITMproxy, and so on) also uses self-signed certificates generated at startup / configuration time rather than a shared root - I think that design is unique to Charles. Charles does allow you to use your own certificate, but it's not the default user flow. I see the ease-of-use case for the way Charles does it, but the shared-certificate approach is so insecure (you're basically handing the keys to all of your unpinned SSL traffic to anyone on the Internet) that I wish it would go away. I also really like Fiddler and the warnings it provides are excellent. Sadly, it doesn't really support OSX yet so many iOS developers can't use it.
- voltagex_ 12y ago
  A very awkward way of using Fiddler from OS X would be via a Windows VM that had Fiddler set up to allow connections from other machines.
- e28eta 12y ago
  I also found it hard to set up Charles to use a custom cert, definitely had to read the instructions on their site instead of trying to figure it out on my own.

fmela 12y ago

mitmproxy does this.

sprite 12y ago

Certificate pin bypass for Android: https://github.com/iSECPartners/Android-SSL-TrustKiller https://github.com/iSECPartners/Android-SSL-TrustKiller iOS: https://github.com/iSECPartners/ios-ssl-kill-switch https://github.com/iSECPartners/ios-ssl-kill-switch Sure it's a little bit extra work but not much. If someone is reversing your app chances are they are using a jailbroken device anyways to extract the unencrypted IPA or to attach gdb to your app.