The Pin Puller's Guide: A Hands-On Guide to Reverse Engineering iOS Applications

No ratings

Presented at CactusCon 13 by

Alex Trudeau

Certificate pinning is a common security measure in mobile apps, making it difficult for attackers to intercept traffic. This talk investigates alternative manual techniques to circumvent certificate pinning without relying on external tools like Frida. These methods offer several benefits, such as increased stealth to evade detection and anti-tampering mechanisms, easier implementation for penetration testing teams, and a deeper understanding of mobile app architecture and security practices. This presentation will delve into a practical approach to circumventing certificate pinning on iOS applications. We will explore the intricacies of reverse engineering techniques, including disassembly, debugging, and code analysis. By understanding the underlying mechanisms of certificate pinning, attendees will gain the knowledge and skills to identify vulnerabilities and devise effective bypass strategies. The presentation will provide step-by-step demonstrations, showcasing real-world examples of certificate pinning bypasses. Attendees will learn how to: * Analyze iOS application binaries to understand certificate pinning implementations * Identify potential vulnerabilities in certificate pinning mechanisms * Employ debugging tools to trace the flow of certificate verification * Modify application code or bundle to bypass certificate pinning checks * Test and validate the effectiveness of bypass techniques