ssl pinning and bypasses: android and ios
TRANSCRIPT
![Page 1: SSL Pinning and Bypasses: Android and iOS](https://reader033.vdocuments.net/reader033/viewer/2022042600/5871989f1a28ab044e8b531d/html5/thumbnails/1.jpg)
SSL PINNINGAND BYPASSES(ANDROID & IOS)
BY
ANANT SHRIVASTAVA
![Page 2: SSL Pinning and Bypasses: Android and iOS](https://reader033.vdocuments.net/reader033/viewer/2022042600/5871989f1a28ab044e8b531d/html5/thumbnails/2.jpg)
ANANT SHRIVASTAVAInformation Security ConsultantAdmin - Dev - Securitynull + OWASP + G4H
and @anantshriTrainer : Blackhat, RuxCon, NullCon, g0s, c0c0nSpeaker : Nullcon, c0c0n, ClubHack, RootConf
http://anantshri.info
Android Tamer Code Vigilant
![Page 3: SSL Pinning and Bypasses: Android and iOS](https://reader033.vdocuments.net/reader033/viewer/2022042600/5871989f1a28ab044e8b531d/html5/thumbnails/3.jpg)
SSL PINNINGAnother layer to achieve secure communication specially protection against MiTM
![Page 4: SSL Pinning and Bypasses: Android and iOS](https://reader033.vdocuments.net/reader033/viewer/2022042600/5871989f1a28ab044e8b531d/html5/thumbnails/4.jpg)
HOW MITM WORKS1. Add Root CA of interception proxy in Browser.
2. Divert traffic via interception proxy, proxy handles SSL Connection
Client <--HTTPS--> Interception Proxy <--HTTPS--> Server1. Browser validates that certificate is issued by Trusted CA and allows
connectionBEFORE AFTER
![Page 5: SSL Pinning and Bypasses: Android and iOS](https://reader033.vdocuments.net/reader033/viewer/2022042600/5871989f1a28ab044e8b531d/html5/thumbnails/5.jpg)
PKI IS BROKEN1. System Trust all CA in Trust Store (PortSwigger CA)2. System Trust's ROOT CA not certification chain3. Any CA can issue certificate to any website (Diginotar, Trustwave, NIC and many
more)4. Certificate Stolen: Welcome to Revocation hell and CRL Nightmare5. OCSP to the rescue over port 806. and many more
![Page 6: SSL Pinning and Bypasses: Android and iOS](https://reader033.vdocuments.net/reader033/viewer/2022042600/5871989f1a28ab044e8b531d/html5/thumbnails/6.jpg)
SO WHAT SHOULD WE DOPin Trust on our own certification chain and validate it at Client Side
![Page 7: SSL Pinning and Bypasses: Android and iOS](https://reader033.vdocuments.net/reader033/viewer/2022042600/5871989f1a28ab044e8b531d/html5/thumbnails/7.jpg)
![Page 8: SSL Pinning and Bypasses: Android and iOS](https://reader033.vdocuments.net/reader033/viewer/2022042600/5871989f1a28ab044e8b531d/html5/thumbnails/8.jpg)
WHAT'S THE CATCH1. What if you get new certificate from a different service provider2. What if your certificate chain changes3. What if certificate is revoked4. What if certificate is stolen5. What is Client is malacious6. What if .....
Answer:
You need to update the code everytime certificate changes
ITS EASY PUSH AN UPDATE
![Page 9: SSL Pinning and Bypasses: Android and iOS](https://reader033.vdocuments.net/reader033/viewer/2022042600/5871989f1a28ab044e8b531d/html5/thumbnails/9.jpg)
SO WHY SHOULD I BOTHER1. Developers : This hinders attacker from traffic interception. Adds another layer
for Attacker to look for. Without Rooting devices its nearly imposible to bypassit so far.
2. Pentesters : This hinders you from inspecting application (be ready forbypasses section)
![Page 10: SSL Pinning and Bypasses: Android and iOS](https://reader033.vdocuments.net/reader033/viewer/2022042600/5871989f1a28ab044e8b531d/html5/thumbnails/10.jpg)
SSL PINNING IN ANDROID& BYPASS
![Page 11: SSL Pinning and Bypasses: Android and iOS](https://reader033.vdocuments.net/reader033/viewer/2022042600/5871989f1a28ab044e8b531d/html5/thumbnails/11.jpg)
HOW TO IMPLEMENT SSL PINNINGMultiple ways
1. Store Certificate in sqlite and use it directly2. Store sha1 hashes and compare3. Store sha1 hash of one element in chain and compare
![Page 12: SSL Pinning and Bypasses: Android and iOS](https://reader033.vdocuments.net/reader033/viewer/2022042600/5871989f1a28ab044e8b531d/html5/thumbnails/12.jpg)
DEMO DETAILS1. We have used a helper library called okhttp by square2. Pins sha1 hashes of entire chain or set of elements in chain
![Page 13: SSL Pinning and Bypasses: Android and iOS](https://reader033.vdocuments.net/reader033/viewer/2022042600/5871989f1a28ab044e8b531d/html5/thumbnails/13.jpg)
DEMO SSL PINNING
![Page 14: SSL Pinning and Bypasses: Android and iOS](https://reader033.vdocuments.net/reader033/viewer/2022042600/5871989f1a28ab044e8b531d/html5/thumbnails/14.jpg)
BYPASS DEMO
![Page 15: SSL Pinning and Bypasses: Android and iOS](https://reader033.vdocuments.net/reader033/viewer/2022042600/5871989f1a28ab044e8b531d/html5/thumbnails/15.jpg)
HOW BYPASS WORKED1. Xposed Framework Hooks into all Function Calls2. Whenever request is made for check function inside
com.squareup.okhttp.CertificatePinner class, return true
Ref: https://github.com/Fuzion24/JustTrustMe/pull/12
![Page 16: SSL Pinning and Bypasses: Android and iOS](https://reader033.vdocuments.net/reader033/viewer/2022042600/5871989f1a28ab044e8b531d/html5/thumbnails/16.jpg)
ANDROID DEMO END
![Page 17: SSL Pinning and Bypasses: Android and iOS](https://reader033.vdocuments.net/reader033/viewer/2022042600/5871989f1a28ab044e8b531d/html5/thumbnails/17.jpg)
SSL PINNING IN IOS& BYPASS
![Page 18: SSL Pinning and Bypasses: Android and iOS](https://reader033.vdocuments.net/reader033/viewer/2022042600/5871989f1a28ab044e8b531d/html5/thumbnails/18.jpg)
HOW TO IMPLEMENT SSL PINNING1. Use Third Party helper like
1. SwiftHTTP2. TrustKit
2. Or Use SecTrustEvaluate via NSURLConnectionDelegate (third party helperbasicly are wrapper to do this)
![Page 19: SSL Pinning and Bypasses: Android and iOS](https://reader033.vdocuments.net/reader033/viewer/2022042600/5871989f1a28ab044e8b531d/html5/thumbnails/19.jpg)
DEMO SSL PINNING
![Page 20: SSL Pinning and Bypasses: Android and iOS](https://reader033.vdocuments.net/reader033/viewer/2022042600/5871989f1a28ab044e8b531d/html5/thumbnails/20.jpg)
HOW TO BYPASS1. 2. (superseeds ios-ssl-kill-switch
works on 9.0.2 also, doesn't work with itunes/appstore by default)
https://github.com/iSECPartners/ios-ssl-kill-switchhttps://github.com/nabla-c0d3/ssl-kill-switch2
![Page 21: SSL Pinning and Bypasses: Android and iOS](https://reader033.vdocuments.net/reader033/viewer/2022042600/5871989f1a28ab044e8b531d/html5/thumbnails/21.jpg)
BYPASS DEMO
![Page 22: SSL Pinning and Bypasses: Android and iOS](https://reader033.vdocuments.net/reader033/viewer/2022042600/5871989f1a28ab044e8b531d/html5/thumbnails/22.jpg)
HOW IT WORKS1. Leverages Cydia substrate2. Uses to inject on process3. Hooks on instead of SecTrustEvaluate or NSURL* as The
Secure Transport API is "the lowest-level TLS implementation on iOS"1. Patch SSLCreateContext(): Disable the built-in certificate validation in all SSL
contexts2. Patch SSLSetSessionOption(): Remove the ability to re-enable the built-in
certificate validation3. Patch SSLHandshake(): Force a trust-all custom certificate validation
MobileSubstrateSecure Trasport API
Reference: https://nabla-c0d3.github.io/blog/2013/08/20/ios-ssl-kill-switch-v0-dot-5-released/
![Page 23: SSL Pinning and Bypasses: Android and iOS](https://reader033.vdocuments.net/reader033/viewer/2022042600/5871989f1a28ab044e8b531d/html5/thumbnails/23.jpg)
IOS DEMO END
![Page 24: SSL Pinning and Bypasses: Android and iOS](https://reader033.vdocuments.net/reader033/viewer/2022042600/5871989f1a28ab044e8b531d/html5/thumbnails/24.jpg)
ANY QUESTIONS
![Page 25: SSL Pinning and Bypasses: Android and iOS](https://reader033.vdocuments.net/reader033/viewer/2022042600/5871989f1a28ab044e8b531d/html5/thumbnails/25.jpg)
ANANT SHRIVASTAVAInformation Security ConsultantAdmin - Dev - Securitynull + OWASP + G4H
and @anantshriTrainer : Blackhat, RuxCon, NullCon, g0s, c0c0nSpeaker : Nullcon, c0c0n, ClubHack, RootConf
http://anantshri.info
Android Tamer Code Vigilant
![Page 26: SSL Pinning and Bypasses: Android and iOS](https://reader033.vdocuments.net/reader033/viewer/2022042600/5871989f1a28ab044e8b531d/html5/thumbnails/26.jpg)
REFERENCESGeneric
1. https://www.owasp.org/index.php/Certificate_and_Public_Key_Pinning
Android
1. 2.
https://github.com/square/okhttphttps://github.com/Fuzion24/JustTrustMe
iOS
1. 2. 3. 4.
https://github.com/daltoniam/SwiftHTTPhttps://github.com/datatheorem/TrustKithttps://github.com/iSECPartners/ios-ssl-kill-switchhttps://github.com/nabla-c0d3/ssl-kill-switch2/