3

What is the best way to analyze requests sent by a mobile application over SSL? The communication protocol is not necessarily HTTP/S so intercepting them with BURP/ZAP/Fiddler or any other HTTP proxy will not necessarily work, but - How do I get the traffic to even reach the proxy?

I've read some material here relating to similar subjects but I couldn't find description of a complete flow I could follow to actually perform this task.

Does the device on which the application is installed need to be rooted for me to perform this task?

If the application uses certificate pinning, is there still a way to do this?

I am specifically interested in understanding how the Whatsapp security model works - i.e. what mechanism do they have in place to prevent a malicious user to fetch the chat history of a legitimate user (seeing as there is no actual login - Is there a cookie/another mechanism sent from the device identifying the user in front of the server?)

My organization is considering implementing a messaging application that works in a similar way and we are trying to make sure that a malicious user cannot steal the identity of a legitimate user. (we are not intending to implement a login mechanism)

  • You can configure a VPN connection to a server you control, and the mobile OS will make all traffic pass through that server where you can capture it. – user42178 Mar 11 '15 at 0:20
3

If your on or have access to a Mac or Linux box, a great application to intercept https traffic along with http is MITMProxy. Not only is it great for viewing the traffic as it is passed through, but you can modify it very easily. All that is needed to view https traffic is to install the provided certificates on the device you want to intercept, then change the proxy settings on your target device to your computers IP, and set the port to 8080. More info is available in their documentation.

  • Thanks.What advantages does MITMproxy have over burp? – user3074662 Feb 8 '15 at 21:45
  • @user3074662 I can't really make a comparison to burp as I've never used it, maybe someone else who's used both could chime in. The only difference I know is MITMProxy is 100% free and open source, and Burp has free and paid options. – ajkblue Feb 8 '15 at 22:14
3

What is the best way to analyze requests sent by a mobile application over SSL? The communication protocol is not necessarily HTTP/S so intercepting them with BURP/ZAP/Fiddler or any other HTTP proxy will not necessarily work, but - How do I get the traffic to even reach the proxy?

For classic HTTPS you should use Burp/Zap/mitmproxy as there're no better alternatives I know of. I haven't really seen any other protocols using SSL/TLS suites in apps, but I would either try to reverse engineer the app to get to the protocol or try to get the encryption keys and decrypt the traffic. But it would take a lot of time.

Are you sure it's really other protocol than HTTPS on non-standard port?

Does the device on which the application is installed need to be rooted for me to perform this task?

You don't need rooted device for HTTPS sniffing, all you have to do is set up proxy and a trusted certificate. For other protocols - well, that depends... You can redirect all the trafic to gateway of your choosing, but as long as the protocol is encrypted I believe that will be not much of the use to you.

If the application uses certificate pinning, is there still a way to do this?

Yes, certificate pinning can be bypassed on both major platforms. Both require root , thought.

  • For Android there's a Cydia Substrate extenstion called SSL Trust Killer which works by intercepting certain calls and modifiyng them to return true during validation. Unless there's a own implementation of ceritificate check, this is going to work. Otherwise, there's most likely implementation bug in certificate checking ;)

  • iOS has several mechanisms, the one I use is through Snoop-it framework. If that doesn't work, you can always revert to method swizzling.

I am specifically interested in understanding how the Whatsapp security model works - i.e. what mechanism do they have in place to prevent a malicious user to fetch the chat history of a legitimate user (seeing as there is no actual login - Is there a cookie/another mechanism sent from the device identifying the user in front of the server?)

My organization is considering implementing a messaging application that works in a similar way and we are trying to make sure that a malicious user cannot steal the identity of a legitimate user. (we are not intending to implement a login mechanism)

Well, your best bet is to hire a capable penetration testers for the application security assessment. I believe the security of WhatsApp should be very high, since they had few nasty security incidents and they are kinda high-profile organization with a large user base and they take security in a serious way... But you never can be too sure.

Hope this post helps a little.

  • Thank you very much for the elaborate response, really appreciate it. The application in question is Whatsapp, from what I understand there is no HTTP/S there. I haven't heard of SSL trust killer, will definetely give it a try. So I have a rooted android running on an android emulator now (andy), and using proxydroid I am having traffic directed to whichever proxy I choose on the host machine. Question is - how do I get the whatsapp traffic decrypted? – user3074662 Feb 8 '15 at 21:53
  • Well that's simple - get the decryption keys. :D No, seriously, I've never tried to decrypt any traffic that's not SSL/TLS. And anyways, if it's not SSL/TLS, how do you want to decrypt it when you don't know how it's encrypted? If you're outta options, you could always revert back to reverse engineeing. – user1164108 Feb 9 '15 at 8:51
  • Essentially this should work similar to burp: you place the certificate on the device's trust store, and then you present the app with a certificate which is signed by the burp CA (in essence this is a MITM attack). So I am looking to do something similar with non http envrypted traffic – user3074662 Feb 9 '15 at 8:55
  • Well yes, but first you need to know what type of encryption is used. Are you sure certificates are in use? It may be some kind of proprietary protocol. I know WhatsApp implemented new end-to-end encryption, but I haven't really researched much about it. – user1164108 Feb 9 '15 at 9:00
0

you could use a few ways to achive that:

if you are using a mobile android device you could connect to a home wireless and use a computer as a host to do a MITM (man in the middle) and direct all of the mobile packets through your host and monitor the packets using wireshark(?)

if you are using an emulator such as BlueStacks you could install ProxyCap and edit the settings to redirect all bluestacks packets through your local ProxyCap.

there are some apps to install on an android device to redirect apps to a proxy but they do not work 100% also most apps does not apply to the proxy rule, also, a root phone gives more options an veriety when messing with this kind of stuff,

if you find more ways to do this please share :)

  • ProxyDroid on a rooted android phone can redirect all traffic to the proxy, as it uses iptables to do the redirects. – ThoriumBR Feb 8 '15 at 13:34
  • @nir How do I solve the MITM issue? I have installed an android device on an emulator I am now routing all the traffic to a host machine, which is my PC. But how do I decrypt the encrypted traffic? – user3074662 Feb 8 '15 at 13:37
  • decryption is the main problem, its not that hard redirecting all traffic to a sniffer, the issue is decrypting the packets – nir Feb 8 '15 at 13:50
  • On the contrary, decryption is very easy. If you're using Fiddler, just browse to ip4v.fiddler:[port] on your phone's browser and download the certificate. – AlexH Feb 9 '15 at 10:01

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.