5 ms·

I was trying to hack/reverse engineer some IoT API calls, and I really wish there was some middle ground between "Don't trust any network, encrypt everything en

I was trying to hack/reverse engineer some IoT API calls, and I really wish there was some middle ground between "Don't trust any network, encrypt everything end to end" and "I can MitM anything I want". Everything on my network is a (sometimes literally) black box sending and receiving who knows what. As a network operator, I should be able to MitM everything on my network. But I don't want people to MitM me when I'm on a public network, so I'm at a loss on how to fix this.

unnouinceput 5y ago
On public network you use tunnels aka end-to-end-encryption. On your private network you control (theoretically) everything.
- teraflop 5y ago
  "Private" and "public" are relative terms. From the perspective of an IoT smart thermostat talking to its mothership, your home network is a public connection, and it's successfully using E2E encryption to protect its private data from you -- even though you theoretically own it.
  - getcrunk 5y ago
    Nice! It's a subtle shift but I think your framing is key.
dec0dedab0de 5y ago
Most b2b gear will play well with a proxy server, and that will allow you to explicitly mitm everything going to the internet. Just don't allow anything else out. One annoying problem is certificate pinning, if you have deices that join your network and others, but it's doable. The real problem is devices sold to consumers that don't allow you to install custom certs or allow you to configure a proxy. There should probably be a law that says every network device should have a means for the owner to decrypt the traffic on the fly.
- candiddevmike 5y ago
  Maybe with some locally installed b2b software, but any kind of hardware device or appliance has trusted root CAs. Unless you have access to one of those, nothing will trust your MitM setup (at least, I couldn't get Nest equipment to connect via a MitM proxy). Maybe there could be some kind standard DHCP option for a trusted root CA on the network. For user controlled devices (i.e. phones), they wouldn't trust it, but any kind of vendor managed device would. Probably too naive of a solution.
  - NavinF 5y ago
    That totally defeats the purpose of TLS. On most home networks, any device can act as a DHCP server. Indeed, a lot of those “limit internet time for kids” devices depend on ARP and/or DHCP spoofing to work. I’m glad the security model of the last couple of decades (trust every device on the LAN) is slowly dying. Oh and adding a nerdy feature to home routers is never gonna happen. Consider how long it took for IPv6 to be enabled by default.
  - wildmanx 5y ago
    A problem is that the easier you make it to sneak in other trusted root CAs, the more you open attack surfaces which malicious parties can exploit. As a device manufacturer that uses certificate pinning, do you really want to trust whatever cheap crap router people have at home to provide a trusted root CA? Let's say that one gets hacked (which happens too often..), you are now also wide open. Sure, it's the owners responsibility, and with certificate pinning that's not configurable, you are depriving responsible owners of the possibility to decrypt their own traffic, but we at least need to acknowledge that there is a balance to strike here, and it's not obvious what the perfect solution would be. Maybe an opt-out of certificate pinning that is so "hard" to reach that it's really only for power users that know what they are doing. (And with "hard" I mean more than some window popping up that says "Are you sure you want to do this? You'll void all warranty blah blah" -- people have already been conditioned to just click away certificate warnings in their browser; the same people would just click anything to just go on with their lives..)
    - 5y ago
cube2222 5y ago
From an SSL/TLS perspective you could have an HTTPS proxy on your network proxying all your traffic and impersonating all websites, by using a certificate authority trusted by your devices. You'd be the sole owner of that root cert / its private key, so you wouldn't have to worry about people in public networks mitm'ing you, but you'd mitm everything on your own network (that is, the traffic coming from devices where you trusted that custom CA). Unless you want to do that with devices that don't explicitly trust your custom CA, but in that case, it's a feature that this isn't possible.
- candiddevmike 5y ago
  I know how to do it, you just can't do it unless you control the device. Which for the IoT devices I'm trying to "hack"/reverse engineer the API server like Nest, I cant change anything.
  - tialaramex 5y ago
    But this is a decision you in effect made, those devices needn't even use TLS, they could use Jim Bob's secret MITM-defeating crypto thing and you can't "hack" that either, you bought devices that are resistant to being reverse engineered. Governments could legislate of course, there could be a rule that means you can't sell Nest because it doesn't have some "hack" feature. After all the EU mandated people provide a sane charge port on phones and it more or less worked, even if you don't live in the EU your phone likely no longer has some arbitrary custom charge port on it, and you can buy replacement chargers or keep the one from a previous phone, reducing waste. You also could legislate from the far end, for public services, you could say if I own a device using my credentials to do stuff, I get to have the agreed key material so that I can decrypt messages after the fact. That's a huge pain to implement, most of the ways to do it make everybody's security a bit worse, but it isn't technically impossible. But technologically we can't change the mathematics of the encryption, Diffie-Hellman works, two parties can agree a secret (which in effect becomes a symmetric key) without either of them uttering the secret.
    - frazbin 5y ago
bmm6o 5y ago
I can't tell if you know this or not, but TFA is not about MitM. Wireshark isn't acting as a proxy, it's using keys saved by the client application to decrypt the traffic after the fact.
- candiddevmike 5y ago
  I know, it's just related to something I was trying to do recently (MitM some IoT devices to inspect the traffic with Wireshark). I wish there was some way to get the PMS on remote devices via a proxy or configuration option.
- bragr 5y ago
  Arguably this is still MitM since Wireshark needs to set up a network tap. MitM does not necessarily require modifying the data. This would work just as well captured at the switch or ISP level if you still had access to the keys.
  - alar44 5y ago
    No, that's not what MitM is. The machine needs to rely traffic whether it modifies it or not. There's nothing in the middle here, clearly. It's saving packets and decrypting later, this is just eavesdropping, it's like a wire tap.
    - deleted 5y ago
      [deleted]
- deleted 5y ago
  [deleted]
GekkePrutser 5y ago
Easy. Set up your own PKI and trust it. Keep the private key safe and nobody else can use it. Only problem is that on Android 7 and above apps can choose to ignore any added certificates in the user store and the system store is off limits. Only way you can do it is by managing the phone in COBO or COPE mode with Android Enterprise. Which requires an expensive MDM system and a factory reset to enroll it. Also the app can do certificate pinning which is even worse to get around. You'll have to modify the actual app. I wouldn't be surprised if this rigmarole was the result of app development companies trying to keep secret how much data they exfiltrate.
- caf 5y ago
  You don't need a factory reset to enrol in MDM, you can create a managed "work" profile and leave the unmanaged user profile alone.
  - GekkePrutser 5y ago
    That is correct, you can enroll into BYOD / regular work profile mode without reset. But for COPE mode and COBO mode you must factory reset to enroll.. because they are triggered in the startup Wizard by tapping 5 times on the background and then scanning the QR code (or by entering the token at the Google setup screen). These are fully managed modes. And those modes are the only ones that allow you to push certificates to the system store. Normal BYOD work profile mode doesn't allow you to do that anymore. They only go into the user store where apps are free to ignore them - since Android 7. This mode is only meant for user owned phones and thus Google wants to limit what you as an admin can do. And manually you can't add them anymore either. So that's why I mentioned the factory reset there.. It really is needed if you want to add root CAs to the system store. (I managed 60.000 phones, 40k of which Android until a couple months ago :)
    - caf 5y ago
      That makes perfect sense though, because presumably the system store would affect all profiles. Sure the app can ignore the user CA store, but it can ignore the system one too and just bring its own CA roots. You certainly still get the "Your organisation may monitor network traffic in your work profile" warning on Android 12 when there's a CA added to the work profile.
vinhboy 5y ago
Are you me? This perfectly describe something I have been wanting to do recently. I really do wish that everything that connect to "MY" network I can inspect freely. This stupid wireless lightbulb I have want to ping home to its manufacturer and I have no way to stop it. I had to go through the trouble of putting it on its own network and blocking it from everything. Very annoying. In the end I returned it because I couldn't trust it.

unnouinceput 5y ago

On public network you use tunnels aka end-to-end-encryption. On your private network you control (theoretically) everything.

teraflop 5y ago
"Private" and "public" are relative terms. From the perspective of an IoT smart thermostat talking to its mothership, your home network is a public connection, and it's successfully using E2E encryption to protect its private data from you -- even though you theoretically own it.
- getcrunk 5y ago
  Nice! It's a subtle shift but I think your framing is key.

dec0dedab0de 5y ago

Most b2b gear will play well with a proxy server, and that will allow you to explicitly mitm everything going to the internet. Just don't allow anything else out. One annoying problem is certificate pinning, if you have deices that join your network and others, but it's doable. The real problem is devices sold to consumers that don't allow you to install custom certs or allow you to configure a proxy. There should probably be a law that says every network device should have a means for the owner to decrypt the traffic on the fly.

candiddevmike 5y ago
Maybe with some locally installed b2b software, but any kind of hardware device or appliance has trusted root CAs. Unless you have access to one of those, nothing will trust your MitM setup (at least, I couldn't get Nest equipment to connect via a MitM proxy). Maybe there could be some kind standard DHCP option for a trusted root CA on the network. For user controlled devices (i.e. phones), they wouldn't trust it, but any kind of vendor managed device would. Probably too naive of a solution.
- NavinF 5y ago
  That totally defeats the purpose of TLS. On most home networks, any device can act as a DHCP server. Indeed, a lot of those “limit internet time for kids” devices depend on ARP and/or DHCP spoofing to work. I’m glad the security model of the last couple of decades (trust every device on the LAN) is slowly dying. Oh and adding a nerdy feature to home routers is never gonna happen. Consider how long it took for IPv6 to be enabled by default.
- wildmanx 5y ago
  A problem is that the easier you make it to sneak in other trusted root CAs, the more you open attack surfaces which malicious parties can exploit. As a device manufacturer that uses certificate pinning, do you really want to trust whatever cheap crap router people have at home to provide a trusted root CA? Let's say that one gets hacked (which happens too often..), you are now also wide open. Sure, it's the owners responsibility, and with certificate pinning that's not configurable, you are depriving responsible owners of the possibility to decrypt their own traffic, but we at least need to acknowledge that there is a balance to strike here, and it's not obvious what the perfect solution would be. Maybe an opt-out of certificate pinning that is so "hard" to reach that it's really only for power users that know what they are doing. (And with "hard" I mean more than some window popping up that says "Are you sure you want to do this? You'll void all warranty blah blah" -- people have already been conditioned to just click away certificate warnings in their browser; the same people would just click anything to just go on with their lives..)
  - 5y ago

cube2222 5y ago

From an SSL/TLS perspective you could have an HTTPS proxy on your network proxying all your traffic and impersonating all websites, by using a certificate authority trusted by your devices. You'd be the sole owner of that root cert / its private key, so you wouldn't have to worry about people in public networks mitm'ing you, but you'd mitm everything on your own network (that is, the traffic coming from devices where you trusted that custom CA). Unless you want to do that with devices that don't explicitly trust your custom CA, but in that case, it's a feature that this isn't possible.

candiddevmike 5y ago
I know how to do it, you just can't do it unless you control the device. Which for the IoT devices I'm trying to "hack"/reverse engineer the API server like Nest, I cant change anything.
- tialaramex 5y ago
  But this is a decision you in effect made, those devices needn't even use TLS, they could use Jim Bob's secret MITM-defeating crypto thing and you can't "hack" that either, you bought devices that are resistant to being reverse engineered. Governments could legislate of course, there could be a rule that means you can't sell Nest because it doesn't have some "hack" feature. After all the EU mandated people provide a sane charge port on phones and it more or less worked, even if you don't live in the EU your phone likely no longer has some arbitrary custom charge port on it, and you can buy replacement chargers or keep the one from a previous phone, reducing waste. You also could legislate from the far end, for public services, you could say if I own a device using my credentials to do stuff, I get to have the agreed key material so that I can decrypt messages after the fact. That's a huge pain to implement, most of the ways to do it make everybody's security a bit worse, but it isn't technically impossible. But technologically we can't change the mathematics of the encryption, Diffie-Hellman works, two parties can agree a secret (which in effect becomes a symmetric key) without either of them uttering the secret.
  - frazbin 5y ago

bmm6o 5y ago

I can't tell if you know this or not, but TFA is not about MitM. Wireshark isn't acting as a proxy, it's using keys saved by the client application to decrypt the traffic after the fact.

candiddevmike 5y ago
I know, it's just related to something I was trying to do recently (MitM some IoT devices to inspect the traffic with Wireshark). I wish there was some way to get the PMS on remote devices via a proxy or configuration option.
bragr 5y ago
Arguably this is still MitM since Wireshark needs to set up a network tap. MitM does not necessarily require modifying the data. This would work just as well captured at the switch or ISP level if you still had access to the keys.
- alar44 5y ago
  No, that's not what MitM is. The machine needs to rely traffic whether it modifies it or not. There's nothing in the middle here, clearly. It's saving packets and decrypting later, this is just eavesdropping, it's like a wire tap.
  - deleted 5y ago
    [deleted]
deleted 5y ago
[deleted]

GekkePrutser 5y ago

Easy. Set up your own PKI and trust it. Keep the private key safe and nobody else can use it. Only problem is that on Android 7 and above apps can choose to ignore any added certificates in the user store and the system store is off limits. Only way you can do it is by managing the phone in COBO or COPE mode with Android Enterprise. Which requires an expensive MDM system and a factory reset to enroll it. Also the app can do certificate pinning which is even worse to get around. You'll have to modify the actual app. I wouldn't be surprised if this rigmarole was the result of app development companies trying to keep secret how much data they exfiltrate.

caf 5y ago
You don't need a factory reset to enrol in MDM, you can create a managed "work" profile and leave the unmanaged user profile alone.
- GekkePrutser 5y ago
  That is correct, you can enroll into BYOD / regular work profile mode without reset. But for COPE mode and COBO mode you must factory reset to enroll.. because they are triggered in the startup Wizard by tapping 5 times on the background and then scanning the QR code (or by entering the token at the Google setup screen). These are fully managed modes. And those modes are the only ones that allow you to push certificates to the system store. Normal BYOD work profile mode doesn't allow you to do that anymore. They only go into the user store where apps are free to ignore them - since Android 7. This mode is only meant for user owned phones and thus Google wants to limit what you as an admin can do. And manually you can't add them anymore either. So that's why I mentioned the factory reset there.. It really is needed if you want to add root CAs to the system store. (I managed 60.000 phones, 40k of which Android until a couple months ago :)
  - caf 5y ago
    That makes perfect sense though, because presumably the system store would affect all profiles. Sure the app can ignore the user CA store, but it can ignore the system one too and just bring its own CA roots. You certainly still get the "Your organisation may monitor network traffic in your work profile" warning on Android 12 when there's a CA added to the work profile.

vinhboy 5y ago

Are you me? This perfectly describe something I have been wanting to do recently. I really do wish that everything that connect to "MY" network I can inspect freely. This stupid wireless lightbulb I have want to ping home to its manufacturer and I have no way to stop it. I had to go through the trouble of putting it on its own network and blocking it from everything. Very annoying. In the end I returned it because I couldn't trust it.