Bypassing regulatory locks, hacking AirPods and Faraday cages

Re:Bypassing regulatory locks, hacking AirPods and Faraday c... by nimih on Tuesday November 12, 2024 @09:13PM (#42122235)

You might need to explain how a VPN solves the certificate pinning issue; the author is already modifying the phone's HTTP/S traffic via a proxied network connection, and a VPN doesn't (to my knowledge) allow you to forge valid HTTPS responses using the pinned server certificate.

[ Parent | on HN ]

Re:Bypassing regulatory locks, hacking AirPods and Faraday c... by notpushkin on Tuesday November 12, 2024 @09:19PM (#42122270)

Sorry, should have clarified: instead of faking the response, you can connect to Apple’s servers through a US proxy. They will see you have a US IP address and return the corresponding location code, all over properly signed HTTPS.

There are a few caveats (e.g. using a residential or mobile proxy would look less suspicious, in case Apple looks out for datacenter IP ranges), but I think it should work.

[ Parent | on HN ]

Re:Bypassing regulatory locks, hacking AirPods and Faraday c... by NavinF on Wednesday November 13, 2024 @01:44PM (#42128726)

He tried that. The phone knows its location using GPS and wifi. Apple doesn't care about your IP

[ Parent | on HN ]

Re:Bypassing regulatory locks, hacking AirPods and Faraday c... by tim-- on Tuesday November 12, 2024 @09:26PM (#42122308)

You don't need to modify the HTTPS traffic. You get a VPS that is in the US, and set the device up so that when it requests the domain (gspe1-ssl.ls.apple.com) that the IP address returned is not an Apple IP address, but the VPS IP.

The VPS simply forwards traffic on port 443 to gspe1-ssl.ls.apple.com.

[ Parent | on HN ]

Re:Bypassing regulatory locks, hacking AirPods and Faraday c... by dmcc365 on Wednesday November 13, 2024 @05:46PM (#42131062)

Have you seen success with this method?

[ Parent | on HN ]