4 ms·
Very interesting combo! Another technique that often, sadly, works is the old school man-in-the-middle. I was recently looking at the api of an app on my phon
by ecesena 12y ago
Very interesting combo!
Another technique that often, sadly, works is the old school man-in-the-middle.
I was recently looking at the api of an app on my phone, using ettercap to arp poison my phone and capture traffic on my laptop. Found the api call was over https (fwd secrecy and all looking good), I tried ssl-mitm with a fake cert... no errors in the app, clear text on my laptop. Happy and sad at the same time. :/
- mdaniel 12y agoWhat an amazing and scary tool (maybe those always go together). I now have a much deeper appreciation for why folks are afraid of Starbucks WiFi.
- notfoss 12y agoAny decent browser will display a certificate error for a Mitm attack. But yes, if you are using other programs/apps over an untrusted network, you can never be sure.
- ecesena 12y agoIt's not actually about the WiFi, secure or not. I was in a WPA2 WiFi. I attacked my phone (at a higher network level), so unless there's an active IDS in place, you can't do much about it. The issue is not the network, but the way the app continued over an insecure connection.
- mobiplayer 12y agoWait a second... Was the fake cert trusted by your phone? If affirmative, did you manually add the root cert from your fake CA or at least accepted that cert as trusted? If you didn't explicitly trust that cert and the application didn't complain we're in front of another completely wrong use of SSL.
- ecesena 12y agoNo, not trusted. That's why I was sad. The app failed to verify the certificate chain and silently continued over the (in)secure connection.