Nedim Fakic - Blog

How I compromised integrity of Twitter Fleets (iOS and Android)

Nedim F — Wed, 21 Jul 2021 13:26:09 GMT

Beginning

At the beginning of May I was learning how to reverse engineer mobile apps. My focus was on iOS at the moment and I was learning a lot about proxies and runtime manipulation. One morning I've got an idea to research how Twitter built Fleet functionality. I went in with idea to simple stop request trough MITM and modify it on the fly. It actually worked!

Note: This isn't security threat per-say, this is issue with compromised show of content!

Writeup

Thinking process

I've never before researched or reported any bounty so I was brainstorming with my developer brain. What happens when I publish Fleet and how that can be modified?! I researched how Twitter handles publishing of Fleets and figured whole process can be modify to actually compromise integrity of Fleet it self.

Writing up POC (proof of concept)

Twitter Fleets integrity can be compromised by sharing tweet using "Share in a Fleet" option. Malicious user has ability to change shared tweet id and trick user in thinking that tweet they are clicking on is legitimate but in reality user can be baited to view a totally different malicious tweet. This issue in Fleets can also result in unableness to "skip" fleet.

Twitter app has a feature to share tweet as Fleet by using built in "Share in a Fleet" option. Creating fleet sends a request to a server that creates an object. That object can be modified to change shared tweet completely, which compromises the integrity of the shared resource. Even more, attacker can "force" user in opening modified tweet by extending media_bounding_boxes width and height values , resulting in "full screen layer" that is completely clickable and can't be skipped.

From:

{...
    "media_bounding_boxes": [
        {
            "anchor_point_x": 0.5,
            "anchor_point_y": 0.5,
            "entity": {
                "type": "tweet",
                "value": "1392985728271884288"
            },
            "height": 0.423306,
            "rotation": 0,
            "width": 0.936
        }
    ],
...
}

To:

{...
    "media_bounding_boxes": [
        {
            "anchor_point_x": 0.5,
            "anchor_point_y": 0.5,
            "entity": {
                "type": "tweet",
                "value": "1392124243710779394" //pointing to totally different Tweet
            },
            "height": 1000.423306,   //tweet can't be skipped because runtime drawn layer will be activated on click event
            "rotation": 0,
            "width": 1000.936  //tweet can't be skipped because runtime drawn layer will be activated on click event
        }
    ],
...
}

Impact

Every shared tweet is suppose to have an integrity . As user of the Twitter app I would expect that shown tweet, is one that gets open if I choose to interact with it. More for, as user of app I would like to have an option to "scroll" through fleets and not be forced to open one. This vulnerability compromises those already made "promises". Malicious attacker can stage scam campaign based on this issue.

Example: Attacker claims to be an account that provides memes of cute dogs, and it create fleets that share a dog related content, but in background attacker is using this vulnerability to pass in different tweets to full fill its malicious agenda . Once users starts interacting with those fleets: User can't skip Fleet User is forced to open tweet, because runtime draw of views with modified width and height User gets redirected to a tweet that is political ad, crypto scam, nsfw content etc.

Video showcase

iOS Fleet showcase

Android crash showcase

Bug bounty process

This "bug" was reported in May 15th, it went trough trough bug triage steps by May 20th.
Escalated to the point where change in values crashes Android app on opening "malicious fleet"
No response from Twitter for 2 months
Me publicly asking whats going on with ticket now that fleet feature will be discontinued
Twitter marking it as "informative" because they couldn't reproduce issue as valid threat!

Stories/Fleets publishing system is flawed, and here is why it "can't be" fixed!

Nedim F — Wed, 21 Jul 2021 13:23:06 GMT

Flawed Logic

Let's first understand how these system actually works. I'll be using Twitters Fleets for example and Instagram Stories are not way behind on this approach!

From users point of view:

User choose image/tweet to share on their story/fleet
User adds some graphic to composer view
Story/Fleet is published

From developers point of view:

User choose image/tweet to share on their story/fleet
User adds some graphic to composer view
App does screen grab of composed view and turns it into image/video
App uploads that created image/video to server
App sends correspondent JSON to describe created story/fleet
App gets network status code if everything went smoothly

From developers point of view you can probably guess where flaw is? Direct flaw here is in trusting integrity of uploaded image with correspondent description on server. Therefor steps 3 and 4 are perfect candidates for evil actor to change integrity of shared values. Servers can record different description that does not equal to sent media. That shows two separate truths and as that should be concerning!

Example:

On image above we can see two different JSON structures. First JSON structure is one before MITM modification, second one shows data after modification. In this example we changed original tweet_id to totally different one (have in mind this can be any valid tweet id). We also modified width and height of view that will get redrawn once Fleet has been open. Adding width of 1000px and height of 1000px will result in end user unableness to skip that Fleet and force user to open it!

With further research I have also concluded that this can result in crash on Android app! If we modify width and height values to larger numbers we can effectively crash Android app when user gets to that Fleet in their timeline!

Show case video:

Fleet flaw showcase

Android crash showcase

Here I would argue that system is simply flawed because it's not checking for changes in media and if they directly correspond to description of data! This flaw shows that server does not check for data validation on its side, so malicious values can be passed!

Why it "can't be" fixed?

Good question! There is always possibilities someone else will find way to make this "spoofing/integrity compromising" attack more difficult but, reality is that client is vulnerable to runtime modifications. In story/fleets case, client is one creating media to be shared, researcher can find way to modify output of called method and we are back on square one!

But when you think about it, this is case in every issue in cyber security, we as developers frequently put various blockades to try and mitigate attacks, this is no different. One more more blockade can go long way!

I thought a bit, what that blockade can be in our case and I came up with this type of "fix"! There is probably plenty more and I would be happy to learn about them, just tag me on Twitter @nedimcodes

Possible added step to mitigate threat

First I would add some metadata to image describing most important values, if post/tweet is in question that should be post/tweet original ID.

On server I would check for post/tweet ID does it match with received metadata, if not then server returns error code! This would simply unable attacker from performing any spoofing on story/fleet.

Issue with this mitigation:

Attacker can simply find what method on client side is responsible for handling appending metadata to image, and modify it on runtime!

I tested my theory on two apps Twitter and Instagram! On Twitter I have managed to modify all sorts of data from size of bounds that gets redrawn in each new fleet view to changing what tweet id is actually getting called!

I've got written confirmation from Twitter to share my findings, after they have labeled my report as "informative". Read more about it here How I compromised integrity of Twitter Fleets (iOS and Android)

Note: Both Twitter and Instagram were notified about these issue trough their bug bounty programs, both platforms responded that they don't think about it as valid security threat!

Appreciation

I would like to thank wongmjane for inspiring me to try iOS security path! I would also love to thank April King from Twitter security for giving me green light to disclose this publicly!

Guide on how to contribute code to Signal

Nedim F — Sat, 27 Mar 2021 14:27:57 GMT

What is Signal

Signal is app that has skyrocketed in popularity with beginning of this year, with huge spikes in user migrating from Whatsapp because controversy new Privacy Policy that was introduced.

Let's build it

First thing to understand, Signal is huge project. It has a lot of code, it was written originally in Objective C but throughout the years new features were added in Swift, so it has healthy amount of both languages in it's codebase.

To even start messing around with Signal you'll have to take care of few things.

Fork Signal project
git clone that project to your mac

You can't just open .xcworkspace and expect app to build and compile. Signal is very complex piece of software that has a lot of parts built into it, those parts have to be compiled before even attempting to do a build.

First thing first, you have to install cocapods-binary. You can do that by typing

gem install cocoapods-binary

Think about cocapods-binary as standard cocapods but for really intensive projects, where build time is really important, and those libraries have to be turned into executable binaries.

Cocapods-Binary project:

It will compile the source code of pods during the pod install process, and make CocoaPods use them. Which pod should be compiled is controlled by the flag in Podfile.

After you have added this dependency, it's time to play around with make files. I was positively surprised how good script was and that make was so effortlessly executed.

Enter this into your terminal shell:

make dependencies this will build out all dependencies that are needed.

At this point Xcode will raise error that it wants to unlock certain files and if you click Yes, it will raise another error saying it can't perform that action. One way of solving this issue is to change permission to root folder of the project Signal in this case and Pods directory with same method.

What worked for me was based on this stackoverflow thread

After you are done with this. Close Xcode and open .xcworkspace. Product -> Clean -> Build

Now we wait till project is built, based on your mac performance this can be very lengthy process, also it can be very resource intensive so my advice is to close Chrome and every other resource intensive app. If you really need to access internet, use Safari while this process is running.

After some time you will get this screen:

Add our own little feature

Painful part has passed, now it's time to have some fun. Signal is impressively clean. They follow simple yet efficient architecture.

First thing to notice when looking at Signal src directory is that it is huge: Simple tree command shows us, it has 1038 directories, 5239 files. Our luck we don't have to understand every part of it.

Let's execute tree command in Signal/src directory: 54 directories, 452 files.

Signal loves to extend on it's own custom classes for example all UIViewControllers in the app are extending from custom class OWSViewController.

(OWS: Open Whisper Systems organization responsible for Signal)

OWSViewController is not only one custom class that you will find, there is also OWSTableViewController2

Inside comments explains it in this way:

This class offers a convenient way to build table views when performance is not critical, e.g. when the table only holds a screenful or two of cells and it's safe to retain a view model for each cell in memory at all times.

Now we have figured simplest parts of the app, time to add some of our code. I have decided easiest thing for us to add, is another option in Profile section.

Time to locate func updateTableContents() method. Inside of it we find mainSection = OWSTableSection() . Let's add one more section.

mainSection.add(.disclosureItem(
      icon: .settingsLink, name: "Something really cool",
      accessibilityIdentifier: "Our new feature accessibility identifier", actionBlock: {
    print("Our new feature")
}))

Put breakpoint under print and run the app. If we go to Settings -> Profile we will see UITableView updated with another section called Something really cool.

Clicking on our new section, rises breakpoint and prints in console our message.

Even though this looks unworthy, it is just a start in complex world of the Signal source.

Closing words

Signal is huge project, you'll need to spend days familiarizing yourself with its complex codebase, but after initial few days of looking for methods and issues, you'll get used to it. Signal app is one of my favourite open source projects when it comes to iOS development, because you can learn a lot by just playing around with features that are already built in.

WHOAMI

I'm Nedim, mobile and backend developer. Most of my time is spent by coding new features for my app Tweetly also I actively tweet about open source projects I try out, just days ago I tried Zoom's new Video SDK, that project I haven't turned into article like this, but it's worthy read as twitter thread.

You can follow me on twitter to be up to date with all my endeavors. Github: nedimf

How to overcome the struggle of not being able to find a fix for a coding problem?

Nedim F — Sat, 13 Feb 2021 14:44:26 GMT

Let's face it, coding is hard. It's hard for a human brain to think like a computer. Unfortunately to understand the problem you have to think like a machine. One thing to have in mind from the very start, no one can teach you how to think. You have to do that all on your own.

You have to practice, more you practice more comfortable you are in your knowledge, by being more comfortable you are making a better foundation. Having a solid and good foundation is key.

How to build a solid foundation

To build a solid foundation you'll need dedication. Lots and lots of dedication. You have to start small. Learn the absolute basics of the topic. If you are learning a new programming language, usually that it is language syntax.

How did you learn to ride a bike, or drive a car? You practiced, those are skills we have to practice every day so we don't forget. The same is with basic math, as a kid, you had to do all these small problems, as homework. Even tho most of us hated our homework, it helped us to understand how basic mathematics works. Apply the same thing to coding as well, when you are teaching yourself basics, be sure to practice them.

Here is an example of what you can build, after you are comfortable enough in the syntax of the language:

This applies only to OOP programming languages

Imagine you are having a bakery 🧁 . Create classes and methods to run your bakery, make it into a CLI app. Play around with language syntax as much as you can. If language has various patterns, try them out.

I think I have a solid enough foundation, what now?

If you think you have a solid enough foundation, you can start by researching your problem. Don't be afraid to use Stack Overflow or any internet resource, there is a good chance, someone already had the same issue and found a solution for it. Especially if the error you are getting is not even your fault, many times it can be IDE just messing with your will to live. jk, ofc.

After you are positive that your problem fix is not a quick search away, then you have to start thinking logically. This part applies to most programming problems, it doesn’t matter if you are a Mobile, Web, or even AI developer.

Break your problem into smaller pieces

To best show this, I'm going to use the example of one of the problems I have faced years ago. When I was just starting coding, I had this cool idea for an app, I can’t really remember what it did, but I know it had something to do with camera and saving photos to a phone storage. The issue was the path that I was looking for, wasn’t valid.

Let say you have the same problem path data://mobile/storage/DCIM/pictures/myimage.jpg isn't valid. The only thing that you know at this point, this path isn't valid, You don’t know why, you just know that image taken does not show when you try to load it.

Let's break our issue into smaller bits: First, we have to check the whole path of that problem. Let's call it our "route to hell". So what does my code do before this issue occurs?

takePhoto() method is called. This method does this and that. Alright, let's see if an error occurs there
takePhoto() returns object TakenPhoto
TakenPhoto contains few object properties, but most importantly it contains path property
Check if the property is alright and if we can access it.

After checking all these little things, we have concluded that "route to hell" is working how it's supposed to. Now it's time to think logically. We start by searching documentation for object TakenPhoto. We came across the developer page for that object and we look for property path. We read documentation about that property. Property path of the object TakenPhoto returns path as String but have in mind that string has prefix data:// in front. Now we have to figure out why the prefix data:// is added in the first place. We search for that answer as well, we find the answer being data:// is added because property path returns place in device storage. Now we have even more information about our problem.

Let's review, we have broken our problem into smaller pieces, analysis of the "route to hell" has shown that all methods are indeed working correctly. Then we have an isolated issue, and we figured that path property is causing us all this trouble. Now we just need to fix it. Easier said than done, right?

Fixing

Our investigation has confirmed that the issue is in path property. We then read documentation in loading images from device storage where we discovered that we have to convert our type String to type URL. We approached converting part

let pathURL = URL(string: path)

Final Test

After few hours of solving this problem, we have finally find a fix. Run it -> Loading ... -> Booom! -> It's working!

Final thought

Being a developer is amazing, it gives you the ability to build whatever you put your mind to. But with power comes issues. Some are solvable in few minutes, some take days or even weeks, but most importantly it's to not quit. You can take few days break, even weeks of break, but solving the problem is the key. Don't quit on the problem, give your best to solve it, solving it even partially can have a huge impact on your career.

About me

I'm Nedim, backend, and mobile app developer, who enjoys working on new stuff every day. Currently, I'm developing this cool app called Tweetly. You can find me on Twitter and be free to DM (@nedimcodes)!

iOS Development How & Where to Start

Nedim F — Fri, 04 Dec 2020 21:47:09 GMT

So you want to make iPhone and iPad apps, that's great. You have been using your phone for a good part of your life and you probably have some great ideas laying around.

Note: This article is not walkthrough tutorial for making your first iOS app. This article focuses the most, what to expect when you start and how & where to start.

To start with iOS development you will need few things:

working Mac computer
XCode

It's just a myth you need newest and greatest to start coding, any decent working macbook should be enough for learning iOS development, builds might take a while, but you can always use that time to reflect on your code, or even better get yourself some coffee.

Xcode

Def. The Xcode IDE is at the center of the Apple development experience. Tightly integrated with the Cocoa and Cocoa Touch frameworks, Xcode is an incredibly productive environment for building apps for Mac, iPhone, iPad, Apple Watch, and Apple TV.

So Xcode is IDE that iOS developers use on daily basis. It has everything you need built in. Do you need cool 3D view hierarchy of your view, or cool debugger to track really annoying crash, everything is already built in Xcode for you to utilise free of charge.

Programming language

There are two types of beginners in iOS. Once who are just starting coding and once who are already fluent in some other programming environments. But both of them have few things in common and they both need to start by learning one of two languages for iOS development.

Wait two? I thought there was only Swift?! Indeed there is Swift but there is also its predecessor which is Objective-C. If you are just starting the easiest way is to learn Swift which is a lot easier to wrap your mind around. Let's see why on an example of creating a function that calculates two numbers.

Swift

import Foundation

func addTwoNumbers(a: Int, b: Int) -> Int{
     return a+b 
}

print(addTwoNumbers(a: 3, b: 3))

Walkthrough:

import Foundation

Imports module named Foundation from iOS standard library
func addTwoNumbers(a: Int, b: Int) -> Int{

This is how we declare function in Swift. You have to use func keyword and then the name you want to call your function such as in our case addTwoNumbers. Our function has some arguments and we can state them as (a: Int, b: Int). Int represents the data type of our argument specific for this example. -> Int means that our function will return data type Int when called
return a+b is just an addition operator
print(addTwoNumbers(a: 3, b: 3)) prints out to console result of our function.

The result will be 6

Objective-C

#import 
int addTwoNumbers(int a, int b) 
{
    return a+b;
}
int main (int argc, const char * argv[])
{
   NSLog(@"%d",addTwoNumbers(1,2));
   return 0;
}

Try directly from your browser online compiler

Walkthrough:

#import

Imports module named Foundation from iOS standard library.
int addTwoNumbers(int a, int b)

This is how we declare function in Objective-C. You have to use the type that you want to returnint (in our case) and then the name you want to call your function such as in our case addTwoNumbers. Our function has some arguments and we can state them as (int a, int b). int represents data type of our argument specific for this example.
return a+b; is just an addition operator
int main (int argc, const char * argv[]) {...} scope where our code will be executed.
NSLog(@"%d",addTwoNumbers(1,2)); return 0; prints out to console result of our function.

The result will be 3

As you can see both of them are quite different syntax-wise. It's totally up to you what you want to use. Just have in mind that Apple has been investing time and money in Swift programming language for years now.

You may wonder why even bother learning Objective-C. When you start coding for iOS you will see that a lot of code in iOS SDK is written in Objective C, and really powerful third party libraries, such as SDWebImage or CocoaAsyncSocket are in whole written in Objective-C. Understanding code that goes to such libraries could really save your time in future.

Resources where you can learn Swift or Objective-C:

You will have more luck learning Objective C from books, so here is one I recommend

Programming in Objective-C

Building your app looks and feels

iOS isn't only about logic, it's also about design. Apple was kind enough to give us developers more than one way of creating views for our apps. You can use:

Storyboards
Programmatic layout
SwiftUI (newest and latest 🤩)

If you are a total beginner start with Storyboards, to get a feel of Auto Layout and how it works, what is trailing and leading and how to align elements to your liking. After you feel comfortable enough in Storyboards, then challenge yourself and write the same views using only code. At first, it will take forever, but later in your projects, it will feel more natural to type a view, then add it through Storyboard.

Note: Don't skip Storyboards, you'll have to learn how to get a visual representation of the app views as a real iOS developer.

I would suggest to read this cool article from SwiftLee Auto-Layout Programmatically

Roadmap

I like this roadmap. It is made for someone who is planning to have iOS as their new career.

Where to start?

I enjoyed taking this FREE Udacity iOS Nanodegree which contains a link for every available iOS course on Udacity. Go at your own pace.

To summarise:

Learn programming language

as much as you can, go over the theory of it, and learn by doing examples, practice it to get a real feeling of how it works. You have to get comfortable seeing code and understanding what it does.
Learn how to solve problems

after you are comfortable enough coding something new, and following tutorial to 'just to have that reassuring feeling' then you can start by solving problems. Programming is all about solving one problem after another, if you learn how to correctly approach a problem you can use that knowledge outside of iOS scope and branch out even more.
Learn how to approach bugs

making errors is the most human thing you can do. Having that error fixed is where the fun comes in, you have to put yourself in 'computers shoes'. Computers think differently, and to understand how they do is crucial to solving a problem. Never hesitate to Google your problems, because there is a huge chance someone already had that same question as you did, days, months, even years ago.