Side note: This wouldn't get around cert-pinning? Even if a new trusted CA is installed on the system, an app implementing cert pinning still wouldn't trust this new CA. Seems that could be a wise move for Facebook's rivals that want to limit snooping.

Edit: on 2nd thought even if Facebook can't decrypt a particular app's traffic, just knowing how many requests it makes, how large they are, and how often, could still provide some useful insights into an app's usage.

If the app is hard coded it shouldn't trust another cert. Note though that browsers, like Chrome, ignore cert pinning if the cert chains up to a locally trusted CA. So the answer is more "It Depends".

> Chrome does not perform pin validation when the certificate chain chains up to a private trust anchor. A key result of this policy is that private trust anchors can be used to proxy (or MITM) connections, even to pinned sites. “Data loss prevention” appliances, firewalls, content filters, and malware can use this feature to defeat the protections of key pinning.

http://www.chromium.org/Home/chromium-security/security-faq#...

EDIT: Spaced on the fact this is a phone app. While Chrome on Windows ignores certificate pins, I'm unsure if this also applies to Android / iOS root stores as well.

So what DOES pinning protect against? Certs generated by state actors with access to CA’s?

That, and (more commonly) CAs mis-issuing certificates to malicious actors due to bugs or weak internal controls.

You can enforce certificate pinning in your own native app. You can even go as far as not trusting the hookable (on a JBen device) system libraries and link in your own OpenSSL or something similar.

I was under the impression Chrome was dropping HPKP support (it was deprecated in 2017), so I imagine this would be across all products - desktop and mobile.

Chrome is dropping support for dynamic HPKP pins (pins that sites can add via headers) but not for static pins (Google domains etc.)

Source: https://bugs.chromium.org/p/chromium/issues/detail?id=779166

> OK, we're looking at removing dynamic PKP in M69. Static PKP will remain until further notice (we have no active plans to remove it right now).

AFAIK, yes. You would have to modify the application itself to disable certificate pinning.

you have root. Might be inconvenient but hardly impossible to modify files to drop your own pinned cert in other binaries.

As I've mentioned elsewhere in other threads, this app doesn't actually obtain root access (that is, it's not a jailbreak); the article/title is confusing a "root certificate" with "root access".

I know Uber and a few other apps certificate pin, since running a mitm proxy myself made Uber non-functional.

You can fix that with https://www.frida.re/

Not without access to a jailbroken device.

Is it possible to set this up to work like charles proxy?

Yeah, the idea is to remove pinning with frida and then your proxy will see all the traffic. There's some sample scripts here, and if you google around you'll find one for iOS: https://codeshare.frida.re/

Jailbreak required, of course.

You are correct!

Many apps do not do pinning currently.

Installing a root certificate is a major breach of privacy. This is what Fiddler does on windows when you need development access to a machine and want to view data being transferred between all websites including https.

By using a VPN they forced all traffic to go through their servers, and with the root certificate, they are able to monitor and gather data from every single app and website users visit/use. Which would include medical apps, chat apps, Maps/gps apps and even core operating system apps. So for users using Facebook's VPN they are effectively able to mine data which actually belongs to other apps/websites.

Lets not forget they can modify the content as well!

Imagine the malicious things someone could do with this level of access. And none of the usual mechanisms to, say, detect widespread compromise of a Certificate Authority would apply here.

They could drain your bank account, hiding the transactions and adjusting the balance whenever you viewed the mobile banking website or used your mobile banking app and adjusting any emailed statements.

They could send messages to your friends and family from your account asking them to send money to you in a certain way or donate money to a "charity", hiding the entire conversation from your view.

They could make some services you use slower or less reliable in subtle ways, to steer you towards the ones they want you to use— the ones that are easier for them to manipulate the traffic to/from.

They could make you think you're going insane, in any one of a variety of ways.

They could gather all of your private information, and then lock you out of your entire digital life all at once. Two-factor authentication wouldn't protect you; they could present you with a fake "re-confirm your settings" process to collect the information necessary to disable or replace the settings. (If you pay your rent using your phone, they could lock you out of your physical life too; they could prevent the payment from going through, show you a confirmation, and suppress notifications of unpaid rent and e-mails from your landlord.)

They could control which news you see, slowly shifting your views on things like privacy and security.

If you get suspicious about any of this, they could plant false information in your search results.

Hm,

- installing root certificate to access encrypted data (potentially of websites? including banking websites?)

- means bypassing security mechanism put in place to prevent people to access data send to a server (from a browser/app)

- means potentially bypassing DRM, too

=> isn't that illegal even if the user agrees to it? (at last in the US where some especially DRM related laws are strange)

No that is absurd, this is standard practice for almost all enterprise setups, as a central component in the deep packet inspection solutions used in network security. So the chance of it being illegal as the user has agreed to participate is absurd. The only thing that would make it so would be to lie about the functionality and intrusiveness.

Remember that in the case of the Facebook VPN, they were asking teens to install it -- which means the teens involved (according to US law) are a protected class: under adult age. Under age folks can't legally agree to participate in anything.

Keep in mind, just because everyone does it doesn't mean squat for is it legal or not. It means it hasn't been tested in the legal system, such that a judgement has been passed regarding legality.

If somehow, the practice were found to be a key part of circumventing some large industry's means of controlling something, it could realistically end up becoming illegal once subject to legal scrutiny.

How would this bypass DRM?

I think the parent is implying that HTTPS encryption is a form of DRM. It's a reasonable question because AFAIK, the DMCA doesn't specifically call out DRM but rather any security/protection measures, so I can see how HTTPS would fall into that.

(However, upthread comments indicate that using certificates to see HTTPS traffic is a fairly common practice in enterprise setups)

On most devices the cert the VPN server uses has to chain up to a trusted root ca.

The article didn't actually mention whether Facebook were MITMing TLS connections by default or whether they'd observed them doing it at all.

Duh ;). FB isn't the only one... So many do this, your head would spin twice and it wouldn't even hurt. People need to see the bigger picture. FB is just one example.

> So many do this

Point out a few? This needs to be common knowledge.

[citation needed]