3 ms·
The first part is the easy part, I have routers and run DNS, and have experience with IPTables, I can usually find ways to get hold of the traffic. The second
by alias_neo 5y ago
The first part is the easy part, I have routers and run DNS, and have experience with IPTables, I can usually find ways to get hold of the traffic.
The second part is the challenge, and for some devices I've been unable to embed my own CA. I was hoping there was a proxy trick or some magic sauce I was missing. Perhaps where DHCP could automatically configure clients with a (insecure) proxy or something along those lines?
- oauea 5y ago> I was hoping there was a proxy trick or some magic sauce I was missing. Perhaps where DHCP could automatically configure clients with a (insecure) proxy or something along those lines? Nope, you're not missing anything.
- alias_neo 5y agoThanks for confirming, will save me some time messing around! Ill stick to getting my soldering iron out and EPPROM dumping/flashing.
- elahd 5y agoYou may be able to intercept a firmware update and load a binary poisoned with your own CA cert. (Lots of factors at play here, of course.) I'm working on a similar problem (https://github.com/elahd/esp2ino/issues/16 https://github.com/elahd/esp2ino/issues/16) with a project I maintain to sideload IoT device firmware (https://github.com/elahd/esp2ino https://github.com/elahd/esp2ino). I've been using both mitmproxy and IOXY (https://github.com/NVISOsecurity/IOXY https://github.com/NVISOsecurity/IOXY), an intercepting proxy made specifically for MQTT. IOXY is a small, less mature project, but it's definitely worth checking out as a compliment to mitmproxy. Many devices managed via AWS IoT phone home over MQTT and, my limited experience aside, it looks like many don't bother validating certificates when authenticating over this protocol.