4 ms·

Very nice writeup. I was kinda hoping to find a way to MITM devices that don't allow the installation of custom CA's. I have some IoT devices that do not expos

by phito 3y ago

Very nice writeup. I was kinda hoping to find a way to MITM devices that don't allow the installation of custom CA's. I have some IoT devices that do not expose a local API and only exposes the data through the cloud, and would like to capture the device to cloud traffic... I guess the only way to do that would be to dump the flash memory, replace the CA and reupload the dump to the device?

punnerud 3y ago
It’s called certificate-pinning if they “hard coded” a certificate, yes then you have to replace/remove it and move the same certificate to your MITM proxy to decrypt traffic. A good write up here for ways to try to intercept IoT devices without any hardware/firmware job: https://robertheaton.com/2019/11/21/how-to-man-in-the-middle-your-iot-devices/ https://robertheaton.com/2019/11/21/how-to-man-in-the-middle...
- lucb1e 3y ago
  Note for other readers: the two sentences in the parent post have nothing to do with each other. The Robert Heathon post does not describe how to break cert pinning without needing hardware/firmware modifications unfortunately. The only relevant thing to repeat here might be this > if you can’t get access to your IOT device’s hardware in order to add a new root CA to it, your journey mostly ends here. Don’t lose hope though. Leave your setup running for a while and see if anything strange happens. When I attempted the above process on my baby’s crib, the device refused to trust Burp’s certificate and so refused to complete a TLS handshake with my laptop. But after a minute or two of repeated failures, the crib started sending out some of its system status data over plain, unencrypted HTTP!
denkmoon 3y ago
> I was kinda hoping to find a way to MITM devices that don't allow the installation of custom CA's The point of TLS is to prevent that... You'd be relying on implementation flaws if it were ever achieved. Frankly I expect the days of being able to install our own trusted certificates are numbered on the few devices that do currently allow it.
- phito 3y ago
  I know that's the point, and I hate it. :)
- throwitaway156 3y ago
  While i agree that TLS will probably be used more restrictively over the years, corporate use should hold back a self-signed CA crackdown.
- goalieca 3y ago
  > Frankly I expect the days of being able to install our own trusted certificates are numbered on the few devices that do currently allow it. For iot security reasons, namely trying to stop persistence of exploits, secure boot features on arm processors will become widely used. Think of it like TPM chips. This will make it much harder to “own your” device.

by phito 3y ago

punnerud 3y ago

It’s called certificate-pinning if they “hard coded” a certificate, yes then you have to replace/remove it and move the same certificate to your MITM proxy to decrypt traffic. A good write up here for ways to try to intercept IoT devices without any hardware/firmware job: https://robertheaton.com/2019/11/21/how-to-man-in-the-middle-your-iot-devices/ https://robertheaton.com/2019/11/21/how-to-man-in-the-middle...

lucb1e 3y ago
Note for other readers: the two sentences in the parent post have nothing to do with each other. The Robert Heathon post does not describe how to break cert pinning without needing hardware/firmware modifications unfortunately. The only relevant thing to repeat here might be this > if you can’t get access to your IOT device’s hardware in order to add a new root CA to it, your journey mostly ends here. Don’t lose hope though. Leave your setup running for a while and see if anything strange happens. When I attempted the above process on my baby’s crib, the device refused to trust Burp’s certificate and so refused to complete a TLS handshake with my laptop. But after a minute or two of repeated failures, the crib started sending out some of its system status data over plain, unencrypted HTTP!

denkmoon 3y ago

> I was kinda hoping to find a way to MITM devices that don't allow the installation of custom CA's The point of TLS is to prevent that... You'd be relying on implementation flaws if it were ever achieved. Frankly I expect the days of being able to install our own trusted certificates are numbered on the few devices that do currently allow it.

phito 3y ago
I know that's the point, and I hate it. :)
throwitaway156 3y ago
While i agree that TLS will probably be used more restrictively over the years, corporate use should hold back a self-signed CA crackdown.
goalieca 3y ago
> Frankly I expect the days of being able to install our own trusted certificates are numbered on the few devices that do currently allow it. For iot security reasons, namely trying to stop persistence of exploits, secure boot features on arm processors will become widely used. Think of it like TPM chips. This will make it much harder to “own your” device.