Context
I am trying to learn more about web security through looking into how various iOS native apps work under the hood. I have been using Burp Suite as the MITM tool to sniff out the network traffic sent and received from the apps, and on the iPhone I have SSL Kill Switch 2 installed to bypass any certificate pinning. It's very interesting and amazing to see how everything works under the hood, for a beginner like myself.
I had no trouble at all with most of the apps, this includes some apps that are supposed to have high security, such as several mobile banking apps - as soon as the SSL is lifted, everything is visible in plain text. Interestingly, some mobile games are giving me a hard time.
Challenge
The intercepted traffic appears to be encrypted JSON files. For example,
{
"F4q6i9xe":{"aV6cLn3v":"542668","Hhgi79M1":"ynB7X5P9"},
"a3vSYuq2: {"Kn51uR4Y":
"f3SQ5sySeaoDupGhGmCD9MKt0V4naBjXXR+jDEjqU1gmL32FgS8v1/6vy61RFO/rwmXwFYZHfTRgV2XujI6U7fESlcSZjMjdeiULExVg0uFmnSgiYA5040hBtuxfFqn+lP1ZCsvnua2IQHoYZDBagkr8I9VZVxQbzivc7rv5d17qscgnD2Jd4BBImn+ohuTpxPEC2H2sLBpAldLe/5EAbXUIkF8griS73lvjyWhmHubZguNUa9EzOCH8o0UPwo5BLB8Fz7xok1GE85/wwSzrlyapQw76/U/RJBF+/0YQ75BACuE4/SfIknim9XZk2EspKrCOu/Gi2K+7pHS+jytfXHR6zTjmeMyV2o967MUVXag="}
}
What I have done
If I understand correctly, I am now in the realms of decryption. Using some analytical approaches I have found from Googling, here are some of my findings (some may seem very obvious and trivial to the experienced):
All requests sent from the app are in this exact format/structure. The encrypted key names are always the same, only the values differ.
The value to the key
aV6cLn3v
seem to correspond to some sort of timestamp, as it is ever-increasing.I previous suspected that the value corresponding to the key
Hhgi79M1
would be some check-bits based on the timestamp, but it is not. Performing the same action in the game will lead to the same value, despite different timestamps. However, different actions will yield different values.The value for the key
Kn51uR4Y
is where the actual payload is. I believe it is a JSON beneath the encryption, but I am not sure.The
/
signs in the payload seem to be separators for segments of data. The second segment/6vy61RFO/
seems to be the check-bits based on the timestamp. Because performing two identical actions in game results in two almost identical JSONs, except for the timestamp and this particular section in the payload.The payload's encryption has got something to do with Base64 or AES, because of the signature trailing =('s), and different payloads' lengths are always multiples of 4. I am not sure if the latter means anything.
The encryption key used seems to be constant. It does not change from different sessions and on different devices.
Question
Am I right in my analysis so far? Where should I go from here? With my almost-null knowledge in these fields, I am not sure what's the next step to take. I am think I might need to decompile the app and look into the binaries to try to see if I can find the decryption key/function lying around. But I am not sure.
I am aware that there will be a lot of learning ahead, but I don't mind it since I am enjoying it very much and I would appreciate greatly some help, even if it's just a quick list of the topics and URLs I should look into.
Update 2015/11/23
I dumped out the decrypted binaries of the app and ran a strings command on them, then I made a Python script to successfully pick out the encryption key. Thanks to all that have helped!