Vimeo App not properly patched #34
Labels
app-specific
Issues specific to a certain app
bug
Something isn't working
certificate pinning
Issues related to certificate pinning
Comments
That's to be expected as it's likely some kind of certificate pinning error, which simply never occurs in the unpatched app, so the developers didn't bother to add a human-readable error message for it. Please connect your device to ADB, run |
|
lots of stuff to sift through, so far for the app itself there are only problems with the analytics printed. 01-25 14:35:27.323 2929 10155 W GAv4-SVC: Network compressed POST connection error: javax.net.ssl.SSLHandshakeException: java.security.cert.CertPathValidatorException: Trust anchor for certification path not found. But i don't think that is vimeo. |
Usually you'd see the app and the library because they're both part of the stack trace. See this issue for an example of that ( |
I assume this one is vimeo but so far there is just gms and localytics stuff on the fiurst glance and no blatant error. Do you see some? |
|
These logs are definitely from Vimeo, but none of them seem to be obviously proxy-related... You said that not all behavior of the app was broken, so I would start the app, run |
|
Should the app still work without proxy if patched? Vimeo fails to connect without proxy |
|
In theory yes, but in practice there are three cases where it won't work:
You can check whether 1. applies by running |
|
It looks like this so far, and the logcat log is absolutely not helpful Raw Vimeo, no repack, no patchesSSL Intercept OFF SSL Intercept ON Repacked, no patchesSSL Intercept OFF SSL Intercept ON Vimeo patched and repackedSSL Intercept OFF SSL Intercept ON Very unfortunate. |
|
I just spent some time looking into this and was able to reproduce the behavior you described. Eventually I realized that Vimeo's Network Security Config already allows user-added certificates (which is usually something that <?xml version="1.0" encoding="utf-8"?>
<network-security-config>
<domain-config cleartextTrafficPermitted="false">
<domain includeSubdomains="true">api.vimeo.com</domain>
<trust-anchors>
<certificates src="system" />
<!-- This line was *already there* -->
<certificates src="user" />
</trust-anchors>
</domain-config>
</network-security-config>It also explicitly allows system certificates which I always thought was implied, but I guess it's not, at least not in this context. I manually added I'm going to investigate the system certificate thing a bit more, but I'll probably release a fix that adds that line by default. In the meantime you can run |
niklashigi
added
bug
niklashigi
added a commit
that referenced
this issue
Jan 30, 2021
Leaving out the relevant line seems to cause issues with some apps (see #34) and including it can't hurt, so why not?
|
so we are at a state where the patched app works if you don't MitM ssl, but fails if you attempt to do so |
|
It seems there are a few errors in https://github.com/google/conscrypt might be worth a look |
|
I've taken a closer look at the APK using APKLab and the Smalidea debugger (my process for that is roughly described here) and found the source of at least some of the problems: Inside the .method public a(Ljava/lang/String;Ljava/util/List;)V
.locals 0
return-void
.end methodAfter rebuilding the APK and installing it again most of the issues were gone. I think there's still a few features that are broken (I'm getting "Something strange occurred" messages at the bottom from time to time), but I can watch videos now and look at the unencrypted traffic. If you want to try this too, please follow the "Making manual changes" guide in the README (either approach will work, but I recommend trying out APKLab just because it's such a nice tool) and apply the change I described above. I'll keep investigating this to see if there's a way to automate this kind of change without hard-coding any Vimeo classes (I don't want to add app-specific patches to |
Closed
|
using j4/t.smali in 3.43.2 seems to be not enough. Still analysing |
|
The problems described here should mostly be fixed by #59, so I'm closing this issue. |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
I ran your script with https://apkpure.com/de/vimeo/com.vimeo.android.videoapp/download?from=details
and installed the patched apk on my phone.
Connecting to Akamai as CDN for the videos was intercepted but the api.vimeo.com which is used for login and other related functions still failed with a shady error , which roughly translates to "we don't know what went wrong".
Connecting without SSL MITM worked fine.
The text was updated successfully, but these errors were encountered: