Bypassing OpenSSL Certificate Pinning in iOS Apps

Re:Bypassing OpenSSL Certificate Pinning in iOS Apps by sjtgraham on Wednesday January 07, 2015 @03:29PM (#8853084)

I don't even attempt to circumvent SSL pinning. IMO it's easier and safer to use Cydia substrate to decorate the networking classes to print args and return values to the console. I've reversed a few APIs in this way, including a bank's.

[ Parent | on HN ]

Re:Bypassing OpenSSL Certificate Pinning in iOS Apps by jerematasno on Wednesday January 07, 2015 @03:50PM (#8853230)

Note that the associated whitepaper discusses using Cydia -- specifically cycript -- to do the same thing.

[ Parent | on HN ]

Re:Bypassing OpenSSL Certificate Pinning in iOS Apps by dmayer on Wednesday January 07, 2015 @05:01PM (#8853606)

Yes, often times that can be sufficient. If you just want to study the protocol or build a custom client. Often times one would like to modify messages of the protocol in order to find flaws in either the server or the client and the ability to man-in-the-middle the protocol makes that easier, in my opinion.

For completeness, the whitepaper is here: http://matasano.com/research/bypassing_openssl_pinning.pdf

[ Parent | on HN ]

Re:Bypassing OpenSSL Certificate Pinning in iOS Apps by wglb on Wednesday January 07, 2015 @06:27PM (#8854035)

Awesome article and white paper.

[ Parent | on HN ]

Re:Bypassing OpenSSL Certificate Pinning in iOS Apps by jerematasno on Wednesday January 07, 2015 @03:52PM (#8853237)

(Modifying the binary is much more fun to blog about, though.)

[ Parent | on HN ]

Re:Bypassing OpenSSL Certificate Pinning in iOS Apps by alimoeeny on Wednesday January 07, 2015 @06:24PM (#8854013)

jerematasno thanks for mentioning cycript. I didn't know about it. Just watched Saurik's intro video. Very fascinating.

[ Parent | on HN ]