Download as PDF, PPTX
Uploaded byAnant Shrivastava
SSL Pinning and Bypasses: Android and iOS
Anant Shrivastava's document discusses SSL pinning for Android and iOS to secure communications against man-in-the-middle (MITM) attacks. It outlines methods for implementing SSL pinning, potential challenges when certificates change, and how attackers can bypass these protections. The document also provides implementation details, tools, and references related to SSL pinning and the associated bypass techniques.
More Related Content
Similar to SSL Pinning and Bypasses: Android and iOS
SSL Pinning and Bypasses: Android and iOS
- 1. SSL PINNING AND BYPASSES (ANDROID& IOS) BY ANANT SHRIVASTAVA
- 2. ANANT SHRIVASTAVA Information SecurityConsultant Admin - Dev - Security null + OWASP + G4H and @anantshri Trainer : Blackhat, RuxCon, NullCon, g0s, c0c0n Speaker : Nullcon, c0c0n, ClubHack, RootConf http://anantshri.info Android Tamer Code Vigilant
- 3. SSL PINNING Another layerto achieve secure communication specially protection against MiTM
- 4. HOW MITM WORKS 1.Add Root CA of interception proxy in Browser. 2. Divert traffic via interception proxy, proxy handles SSL Connection Client <--HTTPS--> Interception Proxy <--HTTPS--> Server 1. Browser validates that certificate is issued by Trusted CA and allows connection BEFORE AFTER
- 5. PKI IS BROKEN 1.System Trust all CA in Trust Store (PortSwigger CA) 2. System Trust's ROOT CA not certification chain 3. Any CA can issue certificate to any website (Diginotar, Trustwave, NIC and many more) 4. Certificate Stolen: Welcome to Revocation hell and CRL Nightmare 5. OCSP to the rescue over port 80 6. and many more
- 6. SO WHAT SHOULDWE DO Pin Trust on our own certification chain and validate it at Client Side
- 8. WHAT'S THE CATCH 1.What if you get new certificate from a different service provider 2. What if your certificate chain changes 3. What if certificate is revoked 4. What if certificate is stolen 5. What is Client is malacious 6. What if ..... Answer: You need to update the code everytime certificate changes ITS EASY PUSH AN UPDATE
- 9. SO WHY SHOULDI BOTHER 1. Developers : This hinders attacker from traffic interception. Adds another layer for Attacker to look for. Without Rooting devices its nearly imposible to bypass it so far. 2. Pentesters : This hinders you from inspecting application (be ready for bypasses section)
- 10. SSL PINNING INANDROID & BYPASS
- 11. HOW TO IMPLEMENTSSL PINNING Multiple ways 1. Store Certificate in sqlite and use it directly 2. Store sha1 hashes and compare 3. Store sha1 hash of one element in chain and compare
- 12. DEMO DETAILS 1. Wehave used a helper library called okhttp by square 2. Pins sha1 hashes of entire chain or set of elements in chain
- 13.
- 14.
- 15. HOW BYPASS WORKED 1.Xposed Framework Hooks into all Function Calls 2. Whenever request is made for check function inside com.squareup.okhttp.CertificatePinner class, return true Ref: https://github.com/Fuzion24/JustTrustMe/pull/12
- 16.
- 17. SSL PINNING INIOS & BYPASS
- 18. HOW TO IMPLEMENTSSL PINNING 1. Use Third Party helper like 1. SwiftHTTP 2. TrustKit 2. Or Use SecTrustEvaluate via NSURLConnectionDelegate (third party helper basicly are wrapper to do this)
- 19.
- 20. HOW TO BYPASS 1. 2.(superseeds ios-ssl-kill-switch works on 9.0.2 also, doesn't work with itunes/appstore by default) https://github.com/iSECPartners/ios-ssl-kill-switch https://github.com/nabla-c0d3/ssl-kill-switch2
- 21.
- 22. HOW IT WORKS 1.Leverages Cydia substrate 2. Uses to inject on process 3. Hooks on instead of SecTrustEvaluate or NSURL* as The Secure Transport API is "the lowest-level TLS implementation on iOS" 1. Patch SSLCreateContext(): Disable the built-in certificate validation in all SSL contexts 2. Patch SSLSetSessionOption(): Remove the ability to re-enable the built-in certificate validation 3. Patch SSLHandshake(): Force a trust-all custom certificate validation MobileSubstrate Secure Trasport API Reference: https://nabla-c0d3.github.io/blog/2013/08/20/ios-ssl-kill-switch-v0- dot-5-released/
- 23.
- 24.
- 25. ANANT SHRIVASTAVA Information SecurityConsultant Admin - Dev - Security null + OWASP + G4H and @anantshri Trainer : Blackhat, RuxCon, NullCon, g0s, c0c0n Speaker : Nullcon, c0c0n, ClubHack, RootConf http://anantshri.info Android Tamer Code Vigilant
- 26.