Before getting hands on with SSL decryption example let us see how actually to be as traffic works.
First of all the application Web browser or in mobile application or request a secured page from the
server the server words serve this request and will send its public key along with the certificate.
Now the web browser or the application will have to do couple of important steps.
First it needs to make sure that the certificate it received is not expired.
It is not revoke and it is issued by a trusted party and it's not like an generic self signed certificate.
And on top of that it needs to ensure that the common name in the certificate matches the name of the
site.
It is connecting to.
So after that the browser will create a symmetric key and sends it to the server by encrypting it with
the public key it's received in step 2.
Now the server will receive this message and will decrypt it using its private key of course.
Now the mobile application the web browser and the web server they have a common symmetric key.
The web server will encrypt its messages its pages information that will send to the client using the
symmetric key and the client will decrypt these information using as well.
The symmetric key taking into consideration what I just mentioned we will take an example of the mobile
application connecting to a server.
Now looking for for vulnerabilities in a mobile application it presents multiple challenges one of which
is the ability to intercept and maybe edit the encrypted communication between the mobile device and
the server it's talking to knowing the content of the communication is very important when we're looking
for possible leaks of information and maybe sensitive information.
Now we will see in the example coming that or how to set up a proxy server that will allow us to analyze
the communication taking place between the mobile application and server.
So you see this is a trivial man in the middle attack.
We redirect that in the traffic going from the mobile application to a proxy server.
For that we need to install these certificate issued by the proxy server which is a self generated or
self signed certificate the certificate needs to be installed on the mobile application.
So now we're trusting the communication with the proxy on our mobile and we will be able to use SS El
here and the cryptic communication since we have the public key and the private key.
So now we have two channels one between the mobile and the proxy and the other between the proxy and
the server the channel between the mobile and the proxy is using our fake or self generated certificate
and we will be able to look into this channel because we have the public cannot private key and the
other channel is actually between the proxy server and this Ota channel server which is using actually
the original certificate provided by the server itself on our mobile application.
As we said we need to change the proxy settings to it fed to the IP and the port number of the proxy.
We have just set up.
It is good to mention that we will be using a proxy server called Charles for this demo.
But you can use any proxy servers available out there because the concept is the same.
You can use burp you can use fiddler you can use men and the middle proxy.
On top of that you can as well download applications especially on Android devices that mimic this whole
setup.
It will be easier for you to just download an application which will install a certificate on the mobile
application and you will be able to monitor or capture the traffic and analyze it.
You can use a search Droid or a proxy droid usually and many other applications on the will store out
there.
So lets go directly and see how we will actually demo the SS out decryption to start with you need to
go to Charles proxy dot com and install the proxy from there.
After that you open the application and you will be presented by this interface.
Now we need to go to our mobile device and drought all the traffic from this mobile through the proxy.
Without you go to the Wi-Fi connection that are currently connected to and then you go to configure
a proxy you select manual and then you use the server and the port which is trials running on to do
that to go to the help menu SSL proc seeing then installed trusted with certificates on a mobile device
and it will tell you it's IP and the port number that it's actually running on.
So now we use this information to configure our mobile to pass all the traffic through the proxy.
Now I'll go to browser here on the mobile and noticed it told me that then browse to this you're all
here to download and install the certificate so it generated a self signed certificate which we need
to install on our mobile device.
To do that we open the browser and go to Charles de
pro for Slash SSL and it will prompt us to install this profile or certificate you just press install
again install and Don now we have installed the certificate.
Now if you go to proxy SSL proxy settings and this should be disabled by default.
So let's not work without enabling SSL proxy.
OK.
I'll just open a generic mobile app from my up for my mobile device and try to log and using these generate
using my password.
Fine.
So just press log in and notice here on the left side.
Charles highlighted this event that is taking place here.
So if you press on that you go here it will tell you that SSL is promising is not enabled.
Then you go to content and see that it is as crammed both content since the connection to the server
is encrypted and we're not able to see any of this traffic.
So to do that or to be able to see or check the tunnel you go to proxy SSL proxy settings then enable
SSL proxy keeping in mind that before it is sold a certificate on our mobile and you just press OK again
will go again to my mobile application and try to let me clear this session here now and fill the mobile
application I'll just log in again.
OK.
You will see that activity here and now you'll see that some of file structure is being populated under
this your l year.
If you go here this file go to contents you will be able to see the username and password that we used
along with other information.
The information on the top is the request and the information at the bottom is the response we got from
the server since this is an authenticated response.
This is what we got from the server from the sequence here.
You will be able to see all of the connections that are being passed through this proxy and the result.
So this is actually a successful attempt.
We got some cookie information API you have information although the attempt to sign in was was not
successful but using that where we were able to get some information go again to this small mobile tried
to sign in with my username and password.
So let me hide this known here and use my username and password to authenticate to this application.
Keep in mind that we are doing this just to test our application if it's really secure over there on
the Internet.
So I'll press now look in and just notice I'll just create a new session here.
Our press log in and you just notice the activity that are taking place under this year.
So I will not press here because you'll see my username and password but actually it's generated lots
of information authorization codes
profile related information.
Cookies.
Some internal hierarchy on the on the server
so the more you navigate through the app the more information you will be able to get.
See I'm not pressing around this application and it's just popping up old information that is passing
through the proxy.
Now as we said earlier we have two connections now from our mobile app through the proxy which is kinda
HDTV now because we were able to decrypt it using our keys that we know and the other connection is
from the proxy to the server itself.
So here we go.
Lots of information just you can get.
You can see all the responses in Jason format.
Let me see what else we can see here.
So the most important thing is that if this proxy is on for example hotspot and users are authenticating
through it they will be able to see all this information I just want to show you this false information
here.
Under the cookies this is the information that we're able to get under the tax form.
You will see this your URL with a device token username and password to authenticate under the form.
This is the information and under the rule format as well similar kind of information.
So and I'm sorry you can use this to generate another attack.
So this is an important piece of information that an attacker can get to perform another attack.
So the recommendation here is to encrypt this information at the application level at the code level.
So don't depend on the SSL or the encrypted tunnel.
No you have to take these security measures at the level of the application itself while writing the
code.
Going back to this slide it's obvious that the mobile application didn't perform some of these steps
correctly.
Actually the mobile application isn't checking that the certificate is issued by a trusted authority
it just accepted over a self signed certificate.
And unfortunately mobile application writers often ignore the need to check certificates and just blindly
accept any SSL certificate without understanding how SSL works to protect against that you need to use
certificate pinning actually when you're doing that you're checking if the certificate name matches
the web server name that you are connected to.
And once you do that you will automatically reject any other certificate.