0

Recently, I read news about Facebook acquired the Onavo VPN company to monitor Snapchat users' traffic. It seems they executed a Man-in-the-Middle attack by replacing the certificate. But could they have executed the same attack if Snapchat had been using SSL Pinning? What are the capabilities of a VPN application installed on a mobile phone?

3
  • It will depend, of course, on the type of VPN.
    – schroeder
    Commented Apr 8 at 15:46
  • 1
    Replacing what certificate? Even without SSL pinning they should not have been able to MITM snapchat without access to the snapchat app. Commented Apr 8 at 22:29
  • 1
    @PresidentJamesK.Polk exactly--certificate pinning isn't particularly relevant since normal TLS defeats a MitM. Commented Apr 9 at 0:54

1 Answer 1

1

Not necessarily. They would have to instrument the runtime of the app and tamper with the certificate's validation logic. This would require either running a Frida server on the device and control it remotely or running a Frida gadget within the very app. A VPN app can of course tamper with the routing table and force all the traffic through its remote endpoint, but can't instrument other app's runtime just like that. It's also limited by the mobile OS' API and the separation layer between the apps installed on the device. So creating a low level network tunnel is not enough to bypass SSL pinning.

Of course, if Snapchat explicitly allowed the company to tamper with the app it would be game over, but I think it's not the scenario we're considering here.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .