Self-Signed, Why Not! Exploiting Insecure Certificate Validation In iOS And macOS
summary
Automated TLS MITM tool certmitm actively generates and injects self-signed certificates and other test cases by freezing the TLS client hello, then probes each intercepted connection to see which validators accept bad certs. It finds ~100 vulnerable apps across iOS, macOS, Android, Windows, consoles and IoT with about 50 zero-days still unpatched; live demos show App Store metadata leaks, Books downloads modified into attacker-provided ePubs, League of Legends iOS leaking authorization tokens, and reported bounties totalling ~$140k.
AI-written summary · about
chapters (6)
- 0:00Introduction
- 3:17Certificates
- 20:44Certmitm demo
- 35:54Apple CVEs
- 40:33Penetration testers & Bug bounty hunters
- 42:05Apple
related talks
48mMobile Security Attacks: A Glimpse from the Trenches
48mChain of Fools: An Exploration of Certificate Chain Validation Mishaps
26mSSL Validation Checking vs. Go(ing) to Fail
39mMobile App Security
47mSecurity Threats & Mitigations for iOS Developers
27miOS Attack Vectors and how to protect your app
13mX.509DoS: Exploiting and Detecting Denial-of-Service Vulnerabilities in
37mEnterprise Apps: Bypassing the IOS Gatekeeper