News for hackers. Stuff that matters.

A comment on Facebook has been paying people to install a “Research” VPN. Parent comment

Re:Facebook has been paying people to install a “Research” VPN by varenc on Tuesday January 29, 2019 @07:08PM (#19031247)
Side note: This wouldn't get around cert-pinning? Even if a new trusted CA is installed on the system, an app implementing cert pinning still wouldn't trust this new CA. Seems that could be a wise move for Facebook's rivals that want to limit snooping.

Edit: on 2nd thought even if Facebook can't decrypt a particular app's traffic, just knowing how many requests it makes, how large they are, and how often, could still provide some useful insights into an app's usage.

[ Parent | on HN ]
Re:Facebook has been paying people to install a “Research” VPN by Gregordinary on Tuesday January 29, 2019 @09:47PM (#19032183)
If the app is hard coded it shouldn't trust another cert. Note though that browsers, like Chrome, ignore cert pinning if the cert chains up to a locally trusted CA. So the answer is more "It Depends".

> Chrome does not perform pin validation when the certificate chain chains up to a private trust anchor. A key result of this policy is that private trust anchors can be used to proxy (or MITM) connections, even to pinned sites. “Data loss prevention” appliances, firewalls, content filters, and malware can use this feature to defeat the protections of key pinning.

http://www.chromium.org/Home/chromium-security/security-faq#...

EDIT: Spaced on the fact this is a phone app. While Chrome on Windows ignores certificate pins, I'm unsure if this also applies to Android / iOS root stores as well.

[ Parent | on HN ]
Re:Facebook has been paying people to install a “Research” VPN by dzhiurgis on Tuesday January 29, 2019 @11:10PM (#19032572)
So what DOES pinning protect against? Certs generated by state actors with access to CA’s?
[ Parent | on HN ]
Re:Facebook has been paying people to install a “Research” VPN by frankchn on Tuesday January 29, 2019 @11:12PM (#19032585)
That, and (more commonly) CAs mis-issuing certificates to malicious actors due to bugs or weak internal controls.
[ Parent | on HN ]
Re:Facebook has been paying people to install a “Research” VPN by jevinskie on Wednesday January 30, 2019 @12:46AM (#19032987)
You can enforce certificate pinning in your own native app. You can even go as far as not trusting the hookable (on a JBen device) system libraries and link in your own OpenSSL or something similar.
[ Parent | on HN ]
Re:Facebook has been paying people to install a “Research” VPN by lol768 on Wednesday January 30, 2019 @04:25AM (#19033747)
I was under the impression Chrome was dropping HPKP support (it was deprecated in 2017), so I imagine this would be across all products - desktop and mobile.
[ Parent | on HN ]
Re:Facebook has been paying people to install a “Research” VPN by Leace on Wednesday January 30, 2019 @07:41AM (#19034576)
Chrome is dropping support for dynamic HPKP pins (pins that sites can add via headers) but not for static pins (Google domains etc.)

Source: https://bugs.chromium.org/p/chromium/issues/detail?id=779166

> OK, we're looking at removing dynamic PKP in M69. Static PKP will remain until further notice (we have no active plans to remove it right now).

[ Parent | on HN ]
Re:Facebook has been paying people to install a “Research” VPN by saagarjha on Tuesday January 29, 2019 @07:11PM (#19031270)
AFAIK, yes. You would have to modify the application itself to disable certificate pinning.
[ Parent | on HN ]
Re:Facebook has been paying people to install a “Research” VPN by gcbw2 on Tuesday January 29, 2019 @07:14PM (#19031295)
you have root. Might be inconvenient but hardly impossible to modify files to drop your own pinned cert in other binaries.
[ Parent | on HN ]
Re:Facebook has been paying people to install a “Research” VPN by saagarjha on Tuesday January 29, 2019 @07:17PM (#19031326)
As I've mentioned elsewhere in other threads, this app doesn't actually obtain root access (that is, it's not a jailbreak); the article/title is confusing a "root certificate" with "root access".
[ Parent | on HN ]
Re:Facebook has been paying people to install a “Research” VPN by judge2020 on Tuesday January 29, 2019 @10:19PM (#19032337)
I know Uber and a few other apps certificate pin, since running a mitm proxy myself made Uber non-functional.
[ Parent | on HN ]
Re:Facebook has been paying people to install a “Research” VPN by QualityReboot on Tuesday January 29, 2019 @10:44PM (#19032465)
You can fix that with https://www.frida.re/
[ Parent | on HN ]
Re:Facebook has been paying people to install a “Research” VPN by saagarjha on Tuesday January 29, 2019 @11:16PM (#19032603)
Not without access to a jailbroken device.
[ Parent | on HN ]
Re:Facebook has been paying people to install a “Research” VPN by lozaning on Tuesday January 29, 2019 @11:10PM (#19032571)
Is it possible to set this up to work like charles proxy?
[ Parent | on HN ]
Re:Facebook has been paying people to install a “Research” VPN by QualityReboot on Sunday February 03, 2019 @08:39PM (#19073357)
Yeah, the idea is to remove pinning with frida and then your proxy will see all the traffic. There's some sample scripts here, and if you google around you'll find one for iOS: https://codeshare.frida.re/

Jailbreak required, of course.

[ Parent | on HN ]
Re:Facebook has been paying people to install a “Research” VPN by willstrafach on Tuesday January 29, 2019 @10:37PM (#19032421)
You are correct!

Many apps do not do pinning currently.

[ Parent | on HN ]