Hello everyone, this is my first post here on BlackHatWorld. I would like to discuss some recent reversing I did for Instagram. Since there is not much information out on this topic (especially for iOS) I figured I would spread some information.
What is SSL Pinning?
According to the internet, SSL Pinning is a technique that we use in the client side to avoid man-in-the-middle attack by validating the server certificates again even after SSL handshaking.
So basically that means we can't just setup Burp and start looking at their HTTP requests.
Why do we want to disable SSL Pinning?
Just like I said above, it blocks us from viewing their HTTP requests. If we can disable it, then we can view the private API.
Disabling SSL Pinning
Ok so first of all, Instagram and Facebook both use TLS 1.3. Personally I have not seen it used in many places, but Instagram does use it. This means we will need a tool that is capable of intercepting TLS 1.3 traffic. This can be achieved by running the .jar version of Burp Suite via command line. You need to run it with any version of the JDK 11 or above (Java started supporting TLS 1.3 in version 11). Setup your iPhone with Burp and we are ready to go!
Now that we have a traffic interceptor setup, time to get to the fun part. You will need a jailbroken iPhone to continue if you are following along.
So right now if we try to use Instagram, nothing loads and we dont see any traffic in Burp. When I try to login, it gives me an error saying "verifier failure: openssl cert verify error....". This is HUGE because now we have a string to look for in their code.
Navigating to the Instagram install location via Filza, I see the main Instagram executable. Trying to load that in IDA gives me no results for the string we are looking for. So I keep looking around in the Instagram directory and find a file named FBSharedFramework. I open this in IDA and boom, there's our string!
Lets take a look its XREFs.
Here is the only function the references this string:
I see at the top there is a BNE that branches to where the string is used. Since it is giving us that error, it is safe to say it will always be branching there, which is what we don't want. Here I can simply change that BNE to a NOP (1F 20 03 D5) to prevent that branch.
Lets apply the change and see what happens! (To apply them I use a hex editor then just transfer the file back into the Instagram directory on my phone)
Trying to login again, and we a get different error message now. I take this as a small W for now lol. The error message now says "openssl cert verify error: self signed certificate in certificate chain". Ok, lets try the same method we used before.
Once again, the string we are looking for is there!
Looking at the function that references this string, it is pretty easy to see where we want to patch it.
At the bottom is the error we are getting. Looking at the branch that happens at the top of that picture, there are two routes. Going to the left will go to the end of the function. Going to the right will run a bunch of other code, and eventually hit the error message we are getting. So lets patch that branch up top to always go left. This can be done with a NOP once again.
Apply that change and send it to the iPhone!
Now I try to log into Instagram again, and... we are logged in! And if I check Burp, we are getting their requests!
We can now look at their private API freely on iOS!
Note: No binaries will be released because it will give everyone a challenge (and I already did enough spoonfeeding lol).
-kurt2467
What is SSL Pinning?
According to the internet, SSL Pinning is a technique that we use in the client side to avoid man-in-the-middle attack by validating the server certificates again even after SSL handshaking.
So basically that means we can't just setup Burp and start looking at their HTTP requests.
Why do we want to disable SSL Pinning?
Just like I said above, it blocks us from viewing their HTTP requests. If we can disable it, then we can view the private API.
Disabling SSL Pinning
Ok so first of all, Instagram and Facebook both use TLS 1.3. Personally I have not seen it used in many places, but Instagram does use it. This means we will need a tool that is capable of intercepting TLS 1.3 traffic. This can be achieved by running the .jar version of Burp Suite via command line. You need to run it with any version of the JDK 11 or above (Java started supporting TLS 1.3 in version 11). Setup your iPhone with Burp and we are ready to go!
Now that we have a traffic interceptor setup, time to get to the fun part. You will need a jailbroken iPhone to continue if you are following along.
So right now if we try to use Instagram, nothing loads and we dont see any traffic in Burp. When I try to login, it gives me an error saying "verifier failure: openssl cert verify error....". This is HUGE because now we have a string to look for in their code.
Navigating to the Instagram install location via Filza, I see the main Instagram executable. Trying to load that in IDA gives me no results for the string we are looking for. So I keep looking around in the Instagram directory and find a file named FBSharedFramework. I open this in IDA and boom, there's our string!
Lets take a look its XREFs.
Here is the only function the references this string:
I see at the top there is a BNE that branches to where the string is used. Since it is giving us that error, it is safe to say it will always be branching there, which is what we don't want. Here I can simply change that BNE to a NOP (1F 20 03 D5) to prevent that branch.
Lets apply the change and see what happens! (To apply them I use a hex editor then just transfer the file back into the Instagram directory on my phone)
Trying to login again, and we a get different error message now. I take this as a small W for now lol. The error message now says "openssl cert verify error: self signed certificate in certificate chain". Ok, lets try the same method we used before.
Once again, the string we are looking for is there!
Looking at the function that references this string, it is pretty easy to see where we want to patch it.
At the bottom is the error we are getting. Looking at the branch that happens at the top of that picture, there are two routes. Going to the left will go to the end of the function. Going to the right will run a bunch of other code, and eventually hit the error message we are getting. So lets patch that branch up top to always go left. This can be done with a NOP once again.
Apply that change and send it to the iPhone!
Now I try to log into Instagram again, and... we are logged in! And if I check Burp, we are getting their requests!
We can now look at their private API freely on iOS!
Note: No binaries will be released because it will give everyone a challenge (and I already did enough spoonfeeding lol).
-kurt2467
