Blog | G5 Cyber Security

Fiddler Traffic Detection

G5 Cyber Security

TL;DR

Yes, applications and websites can detect if their traffic is being intercepted and re-encrypted by Fiddler. This is usually done through certificate pinning or checking for specific TLS/SSL anomalies introduced by a proxy like Fiddler. There are ways to mitigate this detection, but they aren’t foolproof.

How Applications Detect Fiddler

  1. Certificate Pinning: This is the most common method. Applications ‘pin’ the expected certificate (or a part of it) for the server they are communicating with. If the certificate presented doesn’t match, the application refuses to connect. Fiddler generates its own certificates, so this will trigger pinning failures.
    • How it works: The app stores a hash or public key of the expected certificate. When connecting, it verifies that the server’s certificate matches the stored value.
    • Detection: The application logs an error related to certificate validation failure, often indicating a man-in-the-middle attack.
  2. TLS/SSL Anomalies: Applications can check for inconsistencies in the TLS handshake or other SSL protocol details that might indicate interception.
    • How it works: They look for unexpected extensions, cipher suite negotiations, or certificate chain validation issues.
    • Detection: The application may log errors related to invalid SSL configurations or refuse the connection.
  3. Root Detection: Some applications specifically check if they are running in a rooted/jailbroken environment, as Fiddler is often used for debugging on such devices.
    • How it works: They look for specific files or system properties associated with rooting/jailbreaking.
    • Detection: The application may refuse to run or disable certain features if root detection is triggered.

How Websites Detect Fiddler

  1. Certificate Pinning (similar to applications): Websites can also implement certificate pinning on the server-side.
    • Detection: Browser errors related to invalid SSL certificates.
  2. HTTP Header Checks: Some websites check for specific HTTP headers that might indicate proxy usage.
    • How it works: They look for headers added by proxies or unusual header combinations.
    • Detection: Website may redirect to an error page, block access, or display a warning message.

Mitigating Fiddler Detection

  1. Disable Certificate Pinning (if possible): This is often not possible for end-users as it requires modifying the application code.
    • Note: Disabling certificate pinning significantly reduces security.
  2. Use Fiddler’s AutoResponder: Replace responses with pre-recorded data to avoid live connections and potential detection.
    • Steps: In Fiddler, go to the AutoResponder tab and add a rule to replace requests with local files.
  3. Use Fiddler’s Decrypt Feature Carefully: Ensure you are using a valid certificate and that your system trusts it.
    • Steps: In Fiddler Options, go to HTTPS and ensure ‘Decrypt HTTPS traffic’ is checked. Install the Fiddler root certificate in your trusted store.
  4. Modify Application Code (advanced): If you have access to the application source code, you can disable or bypass certificate pinning checks.
    • Warning: This requires significant technical expertise and may void warranties or violate terms of service.
  5. Use a Different Proxy: Some proxies are less detectable than Fiddler, but this is not guaranteed.

Example Certificate Pinning Error (Android)

java.security.cert.CertPathValidationException: Trust anchor for certification path not found.

Important Considerations

Exit mobile version