Hacker News Reader

Comment by sbmthakur | Hacker News Reader

> The majority of the testing is done inside a rooted Android emulator running Android 8 Oreo. Tests that require more capabilities are done on a real Android device running Lineage OS 16 (based on Android Pie), rooted with Magisk.

I don't have much experience with such things. Can such an analysis be done with a non-rooted device?

View on HN

It sounds like they're doing at least some reverse engineering via the Xposed framework, which requires root. However you could probably get similar findings by just sniffing your own network traffic.

Unfortunately with modern iOS/Android you need a rooted device.

Modern iOS/Android have something called SSL Pinning. Which means if you want to use a self-signed cert to Man in the Middle the HTTPS traffic it won't work. So you need to patch the network stack to allow this. I have a spare iPhone I keep rooted for this reason.

You can actually get by without root by using Frida (https://frida.re/docs/android/), at least on Android. By repackaging the APK to include frida-gadget (such as in this tutorial: https://koz.io/using-frida-on-android-without-root/), you can get all of Frida's capabilities on that app without root.

That said, it is more convenient to have a spare rooted phone.

Do all apps use cert pinning? I think it got popular some years ago but I remember some downsides existing

(I know things like Google Apps and such use it, but I'm not sure about less popular ones)

Android apps don't trust user CA certificates by default (they only work with web browsers.) You have to explicitly enable this option in app manifest.

Rooting the device enables you to put custom certificates in system store, and bypass this check.

In my experience only a very small percentage of the apps where I look at the traffic using Charles Proxy have the certificates pinned. Usually it's the stock apps from Apple that are all cert pinned.

Same experience for me across a wide category of iOS and Android apps.

I've done a few and always ran into cert pinning issues.

I haven't run into an app I've reverse engineered that didn't have it.

Then you are sampling a very small or a very biased set of apps.

IMO it's fortunately tho!

> Modern iOS/Android have something called SSL Pinning.

Yep, the mobile OSes have that option, but it’s not very commonly used. I fairly regularly snoop traffic on apps and it’s not super often that I’m blocked temporarily by cert pinning.

Interesting. The last 6 apps I've reverse engineered they all had pinning on.

Reply on news.ycombinator.com