News for hackers. Stuff that matters.

A comment on Bypassing OpenSSL Certificate Pinning in iOS Apps. Parent comment

Re:Bypassing OpenSSL Certificate Pinning in iOS Apps by jerematasno on Wednesday January 07, 2015 @03:50PM (#8853230)
Note that the associated whitepaper discusses using Cydia -- specifically cycript -- to do the same thing.
[ Parent | on HN ]
Re:Bypassing OpenSSL Certificate Pinning in iOS Apps by dmayer on Wednesday January 07, 2015 @05:01PM (#8853606)
Yes, often times that can be sufficient. If you just want to study the protocol or build a custom client. Often times one would like to modify messages of the protocol in order to find flaws in either the server or the client and the ability to man-in-the-middle the protocol makes that easier, in my opinion.

For completeness, the whitepaper is here: http://matasano.com/research/bypassing_openssl_pinning.pdf

[ Parent | on HN ]
Re:Bypassing OpenSSL Certificate Pinning in iOS Apps by wglb on Wednesday January 07, 2015 @06:27PM (#8854035)
Awesome article and white paper.
[ Parent | on HN ]
Re:Bypassing OpenSSL Certificate Pinning in iOS Apps by jerematasno on Wednesday January 07, 2015 @03:52PM (#8853237)
(Modifying the binary is much more fun to blog about, though.)
[ Parent | on HN ]
Re:Bypassing OpenSSL Certificate Pinning in iOS Apps by alimoeeny on Wednesday January 07, 2015 @06:24PM (#8854013)
jerematasno thanks for mentioning cycript. I didn't know about it. Just watched Saurik's intro video. Very fascinating.
[ Parent | on HN ]