3 ms·
It's also easy to set up a man-in-the-middle proxy and watch the network traffic an app is sending.
by joshfraser 12y ago
It's also easy to set up a man-in-the-middle proxy and watch the network traffic an app is sending.
- Someone 12y agoAnd if you can't make head or tails of it, you may conclude "good, it seems encrypted. Unfortunately, that means I cannot tell what they send to their server".
- joshfraser 12y agoI assume you'd set up a custom CA on your proxy so you can spy on the https traffic. I'd be suspicious if I saw large blogs of data that had been encrypted in the application instead of at the network layer.
- Ded7xSEoPKYNsDd 12y agoBut then best practices say you should be doing cert pinning. That will block your CA. Although for most apps modifying that check to look for another cert is probably not too hard. (But of course if the app is obfuscated and does integrity checks on itself, it can get arbitrarily complicated.)
- voltagex_ 12y agoI visit sites with cert pinning at $EMPLOYER. $EMPLOYER runs a very expensive solution from Blue Coat which includes a MITM CA - no issues intercepting anything here. Amusingly, this meant the proxy itself was vulnerable to Heartblead while the client machines were not.
- MichaelGG 12y agoBrowsers know this is s common downside to corp environments and excuse them if the proxy cert is installed. Arbitrary apps don't have to follow that.
- btgeekboy 12y agoThe only foolproof way to get around this is to hardcode the certificate into the application itself, or at least the intermediate chain. Otherwise, you could have always intercepted the first request and made that the certificate of record.