0

I have a Squid proxy installed with HTTPS/SSL support. When I install the generated CA certificate in Firefox and set the proxy, everything looks good -- that is, I can see all the HTTP(S) requests the Squid log files. It also works fine when I install the CA certificate in my emulator (Android 9) and set the proxy. Again, see all the requests in the Squid log files, i.e., the requests made by the browser or the apps that use the proxy settings.

However, when I do the exact same steps on a real device (Samsung A30s with Android 9), I have problems. Well, I still see all the requests made by the browser, but not the ones made by apps (and thus they yield connection errors). OK, I still can see the CONNECT request in the logs but no other requests (e.g., GET, POST). So the apps are definitely using the proxy settings. (I know that some apps like Facebook ingore the proxy settings and connect directly to their server; they still work fine, of course).

The odd thing is that everything was working on an old Android 6 phone. Here the same apps where working perfectly fine using the proxy and relying on HTTPS requests. Now I have a newer Android 9.0 phone and all apps so far fail. The apps obviously use the proxy (seeing the CONNECT entries in the logs) but seem to not not use/acknowledge the installed certificate.

Can the newer Android version be an issue? Maybe permissions? Can it be that the newer Samsung phone has some bloatware that requires additional settings or something (the old phone was a OnePlus with an almost stock Android version as far as I know)?

Improve this question
4
  • 1
    "Apps that target API Level 24 and above no longer trust user or admin-added CAs for secure connections, by default.". API 24 is Android 7. So you need to add them to /system/etc/security/cacerts
    – Irfan Latif
    Mar 13, 2020 at 9:58
  • @IrfanLatif thanks! Yes, that must be the problem. If I may clarify with you -- sorry, I'm not Android crack and only started looking into this for user study for a research project -- do this only work with rooted phones? All tutorials I found for storing certificates in /system/etc/security/cacerts require su to remount the file system as writable.
    – Christian
    Mar 13, 2020 at 10:54
  • 1
    Yes definitely. /system can only be modified with root access. dm-verity (Verified Boot) must also be disabled, or you may use bind mounts (see Magisk documentation for details). But please note that the app which are not proxy-aware (as you have mentioned) and those using SSL pinning will still not work with proxy. You need to perform extra steps to make them work. See some more details on using proxy on Android devices in this answer and the links given inside the answer.
    – Irfan Latif
    Mar 13, 2020 at 11:04
  • 1
    Very much appreciated! This SLL pinning is new to me and I have to read up on it, but I've noticed the problem since I got the Twitter app only running if I exclude on the proxy side. I was afraid of such obstacles, of course, since we essentially want to play a man-in-the-middle attacker, although for an IRB approved user study after signed consent :). Our currently last option we are looking into are an app that runs a local VpnService. But the solution I found works far from stable (I might post a separate question).
    – Christian
    Mar 13, 2020 at 11:27

0

Reset to default

You must log in to answer this question.

Browse other questions tagged .