Hacker News Reader

Comment by victoknight | Hacker News Reader

<spolier> guess who doesn't verify the root CA. Think of all the fun to be had with a Siri man-in-the-middle

Missing the point, I think. There's no security bug here. The application isn't responsible for verifying the root CA in typical security models (though some, like Chrome, do something similar -- that's how the compromised Dutch CA was discovered). The idea is that the CA list is populated by your platform vendor and you trust it.

The trick here was that Siri was asking for an HTTPS connection to a named server, and you can't MitM that without having a signed cert for that server. So they added a new CA to their local (jailbroken) iPhone platform data and signed a cert for the Siri server.

And for anyone thinking about ways to fix that problem, the researchers could have hooked SSL's read/write calls using a DYLD interposing library. Once you get superuser access on the phone, you can't trust your code to be safe.

There is no jailbreak for the iPhone 4S (at least not publicly available), so any hacks like this must be done from outside the device.

No, it's not jailbroken (there's no jailbreak for the iPhone 4S). This is just a feature of the iPhone: if you embed a SSL certificate in a mobile provisioning profile, it will add it to the system list. This is mostly intended for enterprises who might have a special SSL cert for their intranet, but it also works for this purpose as well.

Have a look at the HTTP-proxy software Charles (No affiliation of mine.) In the last question of the FAQ the monitoring of SSL-connections within iPhone-apps is explained: http://www.charlesproxy.com/documentation/faqs/

There is no bug. This is what SSL will do, when you install additional certificates.

(Oh, and it's a fun way to find new web services to play with.) :-)

Yeah - Fiddler2 http://fiddler2.com/fiddler2/ does this too. It's really neat for debugging http based API calls.

You can add a root CA to both linux and os x. No problems. Though on an iPhone you'll have to jailbreak it first...so I guess apple didn't think of that, or they don't care.

No, you don't. Installing a root ca an iOS device is as easy as sending it via mail to the device and then clicking on it (with a few more clicks to confirm).

edit (because I can't reply): It does show a big warning and you have to enter the device unlock code to do this, so it should be reasonably safe.

Hmm. That sounds like a big security hole. Phishing attacks in particular. Though I guess the extra clicks should discourage users.

It is necessary — some places have custom non-public CA's, for things like S/MIME and internal servers.

On the other hand, I'm pretty sure Siri doesn't have to communicate with your company's internal servers (and my paranoia already suggests a malicious IT department, reckless — and probably illegal — as that would be), so the code should, in my opinion, accept only specific CAs.

Compartmentalization would make sense. Installing a root CA in the email app would only work for the email app.

Reply on news.ycombinator.com