0

I'm updating an iOS app and I want to prove that it is vulnerable to MiTM attack.

I have set up Charles Proxy on my mac and configured the Simulator so that it trusts Charles CA Certificate, per these instructions: http://www.charlesproxy.com/documentation/faqs/ssl-connections-from-within-iphone-applications/

I am able to run the app and now I see the HTTPS traffic in Charles, in clear text. OK, Good.

Is this enough to show MiTM vulnerability?

I was thinking that to really prove it, I would need to set up a sniffer, etc. on a server on the network. But maybe this is too much work. Charles is a proxy, so is showing unencrypted traffic in Charles good enough?

Improve this question
1
  • 2
    If you installed a new certificate on the device so it trusts the proxy, then you can't prove that the app is vulnerable to a MiTM attack. It would be proven vulnerable if you were able to catch clear network communications without doing anything on the device.
    – Corneliux
    Commented May 6, 2014 at 9:16

1 Answer 1

Reset to default
6

SSL is used to prevent MiTM by assuring Confidentiality, Integrity and Authentication. SSL is based on trust. There are trusted root certificates which sign other certificates (which the user can verify) to proof their identity. If a root certificate gets compromised, then all certificates signed by this and transitively signed certificates are to be treated as compromised. The trust chains are hard coded within your applications or your operating system. Some applications are just configured to trust all certificates the operating system trusts.

If you add a certificate authority, then you are essentially saying to your device that the certificate is to be trusted. In your proxy you then use it to perform the MiTM with the certificate you compromised yourself. So you haven't proven anything, you just breached your own trust chain and removed the one layer protecting you from a MiTM.

Setting up a sniffer will normally just show you encrypted SSL traffic.

Some applications, especially on more sensitive mobile devices, can perform certificate pinning. This means that the application does not trust the Operating System's certificates, but ony trusts those certificates which were hard coded within the app.

Improve this answer
2
  • Thanks very much. That makes sense. I was confused by the step to configure the simulator to trust the Charles certs (to really prove MiTM I didn't think I'd have to do this), so you've confirmed my doubts. So, from what you're saying, Cert Pinning is useful for when the device itself is compromised, such as a jailbroken device.
    – Darren
    Commented May 6, 2014 at 10:08
  • 1
    It can help make things more difficult and will also prevent a normal user from accepting certificates. However a compromised device usually means you can only make stuff more difficult, but not impossible.
    – Lucas Kauffman
    Commented May 6, 2014 at 11:24

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .