Leon Jacobs - Meticulously Modern Mobile Manipulations
Presents a systematic methodology for intercepting and manipulating traffic from modern mobile applications that implement certificate pinning and root detection.
Summary
Modern Mobile App Interception
Leon Jacobs presents practical techniques for intercepting and manipulating network traffic from modern Android and iOS applications that implement multiple layers of anti-analysis protections.
Certificate Pinning Bypass
The talk covers bypassing certificate pinning using Frida dynamic instrumentation, hooking the platform SSL libraries at the function level to override pinning checks. For apps with multiple pinning layers (HTTPS, WebSocket, gRPC), Jacobs demonstrates a systematic bypass methodology.
Root/Jailbreak Detection Bypass
Root and jailbreak detection checks using file system probes, package manager queries, and native code integrity checks are bypassed using Magisk Hide (Android) and Liberty Lite (iOS), with Frida hooks handling any remaining programmatic checks.
Deep Traffic Analysis
With interception established, the talk demonstrates modifying API responses in transit, replaying authenticated requests with modified parameters, and extracting API keys and session tokens from intercepted traffic.
Related talks
Village Interviews·9 min
d3dbot
d3dbot catches up with the Mobile Hacking Community at DEF CON 33, exploring baseband analysis, Android internals, and iOS jailbreaking research.
Main Stage·47 min
Hugo Gonzalez · Caleb Howell
Deconstructs the anti-cheat and runtime integrity mechanisms in Pokemon Go, demonstrating mobile reverse engineering and integrity bypass tradecraft.
Main Stage·46 min
Xiling Gong · Eugene Rodionov
Vulnerability analysis and exploit primitives targeting mobile GPU drivers to achieve local privilege escalation and Android root.