With Meta’s Messenger application for macOS being so close to the Texts.com model—that being a standalone desktop application—Batuhan İçöz who is leading the Meta platform project at Texts.com thought we could gain some valuable insight by analyzing it. Everyone knows that intercepting network requests is a great and low barrier-of-entry first-step.
Meta implements certificate pinning into their applications which enhances their security model, and prevents us from being able to execute a MITM (man-in-the-middle) attack on ourselves to analyze the requests made to their servers.
What is Certificate Pinning?
When you set up a proxy client capable of intercepting your requests, you’re forced to configure and trust a “certificate authority,” one which you created. Certificates issued by your certificate authority will be used and will be able to intercept and decrypt information pertaining to the requests.
If a service implements certificate pinning, they’ve effectively opted to accept certificates issued only by specific certificate authorities, preventing certificates issued by your certificate authority from being used.
With certificate pinning enabled, our self-signed certificate is invalid, and thus our requests cannot be intercepted.
Default Behaviour
Without disabling certificate pinning, all requests return an “Internal Error” and our proxy software indicates that the “SSL Handshake Failed” with the request not completing its lifecycle. We thus can infer no information about the request.
Desired Behaviour
We want to be able to successfully make requests and read the request, response and headers from our network debugging tool by using a MITM attack on ourselves.
Potential Approaches
One option I’ve found to work in the past would be to alter the URL strings in the binary to insecure self-hosted endpoints that don’t implement TLS. It would forward requests and responses between the end-client and end-server. This works best for smaller applications, unlike Messenger.
We could use a dynamic instrumentation library, such as Frida to achieve the desired outcome. I’ve found that Messenger in particular is prone to crashes when hooking into it and with all this overhead, it can be difficult to pinpoint the pain-point. There’s also the more complicated distribution process involved with Frida. Those who wanted to run it would need to configure a very specific environment and set of tools.
Despite this, I did attempt to use a Frida script that I’ve been maintaining over the past few years that works to bypass common certificate pinning libraries and methods. It works on the vast majority of applications. Unfortunately, Meta’s subset of applications is not part of this “vast majority.”
In this case, we’ll be looking to turn off certificate pinning entirely in a way which can be easily distributed to my fellow team members using binary patching.