Hacker News Reader

Comment by walterbell | Hacker News Reader

How do researchers find this information? Presumably the apps are using encrypted network connections to submit your location data to surveillance backends. Is guardianapp reversing each application using jail broken devices? Using an iOS emulator to inspect the running app?

View on HN

A lot of work went into rooting out these trackers, what data they sent, and what apps they were in. We used a combination of static code analysis for each, runtime analysis (eg. Corellium), and network packet capture/analysis.

The good news is that only that last part is required if you would like to try this, now that the commonly used hostnames are published.

Folks can add the full list to a system such as Pi-Hole, and if they notice any hits for the listed servers, they can then route their device traffic through a tool such as Bettercap or Burp Suite in order to discover the offending app(s) and what information they are sending.

> We used a combination

You were involved? Why am I not surprised! Thanks for doing your part my friend.

can you tell me a bit about him?

He tells enough in his HN profile;

information security research. ceo @ sudo security group (https://verify.ly).

previously: founder of "Chronic Dev Team" responsible for many years of iOS jailbreaking solutions (24kPwn, absinthe, corona, greenpois0n, etc).

https://duckduckgo.com/?q=will+strafach

https://www.google.com/search?q=will+strafach

http://www.bing.com/search?q=will+strafach

Not to be a smartass (otherwise I’d have used LMGTFY for the URL), but seriously there’s a ton of info simply gathered just by searching his name.

now that the commonly used hostnames are published.

The problem I see with that is that apps could easily start proxying the requests though their own servers.

I personally believe this is unlikely, because then the firms paying for this data will not be so sure that the information is legitimate, whereas collecting directly from user devices makes fraud more difficult.

Are you sure that that is actually a big problem for them? I imagine it would be quite hard to convincingly fake user data data.

I could also imagine ways around that. For instance their proprietary SDK could generate the data and cryptographically sign it. Or they could require that app makers set up a special subdomain that points to their ip address. I guess it would only be worth the trouble if enough people care about it.

It is most definitely a problem. Detecting fake clicks is hard enough even when the links are pointing to ad-tracking hosts. In fact browser adblocking could be wiped out instantly if ad networks trusted websites to report their own hits.

That day probably someone will write a browser extension that does essentially what trackmenot did against search engines: make noise. That is, as soon as the user loads a page, N threads would crawl the same page in background and start random silent clicking while the user surfs normally. They could even make a memory map of the site and assign the random clicking to any of the active connections just in case on the other side someone tries to filter against the connection order (1st one is the user, from 2 on they're bots).

Not certain what you mean about the IP address, but for signing it, they would need to bundle a key and that could be extracted.

It is a genuinely tricky challenge from their perspective.

Where can I look at the published list of hostnames?

They seem to be published here: https://guardianapp.com/ios-app-location-report-sep2018.html

Why doesn't Apple disclose the entitlements they have approved for every app on the app store?

Approving entitlements is exceptionally rare honestly.

The only app I have found this happen with is Uber:

https://www.businessinsider.com/uber-iphone-app-secret-acces...

I mean things like "This app can use location services and access the Internet", like Android has. Why doesn't Apple disclose these sandbox limitations?

Lots of ways

1. You can inspect HTTPS traffic by installing a trusted MITM cert on your device - no jailbreaking necessary.

2. You can inspect the libraries provided by the owners of tracking endpoints to see what they collect and transfer.

3. Decompiling app bundles is usually pretty effective, and you can download them straight from iTunes.

You cannot decompile apps without a jailbroken device, as they're encrypted with FairPlay. And iTunes, at least with the latest version, no longer lets you download apps.

There are ways to download apps on a desktop without using iTunes.

I am aware of these methods. Just pointing out that iTunes no longer does this.

Do tell

Just making an observation. Can’t relate hearsay, that might even violate rules.

Why would it violate rules?

iTunes 12.6.3, which is still available on Apple’s website, or through Apple Configurator.

> 1. You can inspect HTTPS traffic by installing a trusted MITM cert on your device - no jailbreaking necessary.

Then they'll just move to pinned certs in the apps?

They can (and should, in general) but often don't, because it's a lot more work. The point is, in practice self-MITM very often works.

It's hardly doable in practice. For example, certificates have to be updated at least yearly, leaving your app completely broken unless updated.

1a. You don't have to pin the leaf. You can pin an intermediate

1b. Or you can pin the public key and ignore the certificate altogether, new certificates for the same key can be obtained as necessary.

2. The maximum certificate lifetime is currently 825 days, which, unless you're on another planet, is not "yearly".

3. If you're pinning for an application (not a generic website accessible in browsers) you don't need a certificate from the Web PKI at all, you can mint your own, ignore the lifetime rules, write Emoji in the Common Name field, use a different RSA exponent, the world is your oyster.

1a. You can't control what root/intermediate will be used by your certificate supplier one year from now.

1b. You should not reuse private keys between certificates and never for intermediate or root.

2. It's yearly or 2 years for the most common suppliers.

3. Have fun getting your certificate accepted from every device and operating system.

Anyway. I am not saying that it can't be done, I'm saying that there are a lot of challenges to doing it properly and any mistake will make the app completely broken.

> Have fun getting your certificate accepted from every device and operating system.

You have full control in a native iOS app over which certificates you accept or reject. Which is why the author specified that the trick would work if the endpoint is just for apps.

Clever but if you try tricks like that you can’t use the system libraries which is rather inconvenient.

As far as I know, all of the above is possible to implement with the hooks that the system provides, at least on iOS.

If you submit an app you have to set a flag indicating what kind of communication you’re going to use. If it’s not a secure connection using valid certificates you have to use the ‘insecure connection’ flag and that will cause extra review steps. If there’s no good reason you’ll be denied.

I’m having difficulty installing a MITM cert on my iPhone 7. Does anyone have advice or can recommend some literature to do so?

Making a configuration profile that contains your custom root CA is the easiest way to go.

> How do researchers find this information?

The first suspicion arises when the app uses more bandwidth if you move it a lot, compared to the app on a stationary phone. I guess researchers can emulate the "moving". And they can virtualize the clock as well. So in principle they can send the app around the world in a matter of seconds and see what the app does on the network.

I’ve reverse engineered ssl encrypted iPhone app traffic before using Charles proxy and a self generate ssl cert to decrypt the requests. From there, you can see which endpoints are receiving what data in plain English.

I’ve only done this for apps not using certificate pinning. It gets more complicated from there.

Check out CharlesProxy in the iOS App Store. You can intercept and inspect the SSL traffic without needing another device or external service.

Check out the following:

https://mitmproxy.org

https://jimshaver.net/2015/02/11/decrypting-tls-browser-traf...

> iOS emulator

No such thing exists

Yes, it does. Search for “Correllium”.

Extremely few applications pin the certificates. You just need to install a self signed one on the device and then you can MITM.

Reply on news.ycombinator.com