Hacker News Reader

How did you reverse engineer the Natwest/Ulster/RBS app. It is my understanding they use certificate pinning?

They do pin certs. I don't disable pinning, I quite like the protection it gives me. I actually inject code at runtime to observe and modify behaviour.

Interesting. I've sent you an email about using teller. Hopefully you give me a shot at it.

Certificate pinning is easy to defeat.

Doesn't exactly answer the question..

If you can run the app on a jailbroken/rooted device, it's fairly easy to beat certificate pinning in a few different ways. Two that come to mind are:

* find the certificate file in the app and replace it with your own.

* hook the function that verifies the certificate and make it return true.

If you tried reversing the app in question, none of these methods work as the app has a couple of protections against changing its code.

Reply on news.ycombinator.com