13

I tried to capture the send-out traffic of the Android app (Google Drive, Facebook, etc.). This is my security thesis. I succeed capture send-out traffic on the Google Drive app with Mitmproxy but with Facebook and Messenger, I can't. I have tried with Burp Suite too but it shows the same error.

It showed this error:

[22:31:04.915][192.168.1.14:54628] client connect
[22:31:05.034][192.168.1.14:54628] server connect graph.facebook.com:443 (31.13.86.8:443)
[22:31:05.094][192.168.1.14:54634] client connect
[22:31:05.134][192.168.1.14:54634] server connect graph.facebook.com:443 (31.13.86.8:443)
[22:31:05.186][192.168.1.14:54628] Client TLS handshake failed. The client does not trust the proxy's certificate for graph.facebook.com (sslv3 alert bad certificate)

Even though I added the Mitmproxy certificate and Burp Suite certificate to the Android system certificate, it seems not to work with Facebook. enter image description here

Thank you

1 Answer 1

40

Facebook uses Certificate Pinning which prevents attacks like yours.

What Is Pinning?

Pinning is the process of associating a host with their expected X509 certificate or public key. Once a certificate or public key is known or seen for a host, the certificate or public key is associated or ‘pinned’ to the host.

What Facebook says about it?

To protect over two billion people using Facebook products, our mobile apps implement security mechanisms such as Certificate Pinning. These mechanisms are designed to raise the barrier of entry for an attacker...

Nevertheless Facebook offers an option to analyze traffic from your own device for Whitehat bug bounty purposes:

For the security of your account, we advise turning these settings off when not testing our platform to find Whitehat bug bounty vulnerabilities.

If you activate these settings, you can view the traffic. But obviously you cannot consider it as a weakness of the app. This is a part of their normal functionality.

0

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .