Nullcon Goa 2023 | Self-Signed, Why Not! Exploiting Insecure Certificate Validation In iOS And macOS

In this talk, Aapo Oksman discusses the critical issues surrounding TLS authentication and certificate validation in iOS and macOS. He highlights a history of insecure server certificate validation and presents recent exploits targeting Apple's certificate processes. The session introduces certmitm, a new tool designed to automatically discover insecure certificate validation vulnerabilities in TLS clients. Through demonstrating these exploits and the capabilities of certmitm, the speaker emphasizes the need for improved security measures to protect against these vulnerabilities.