Tag Info

New answers tagged

1

As per this StackExchange answer, you can find it using lsof by looking for st=07 on a raw socket: # lsof -n | grep -i st=07 ping 19241 gowenfawr 3u raw 0t0 477269 00000000:0001->00000000:0000 st=07 # ps aux | grep 1924[1] gowenfawr 19241 0.0 0.0 8596 832 pts/0 S+ 07:26 0:00 ping ...


2

These days basic Software Defined Radio (SDR) kit has become very affordable so you can now obtain the RTL-SDR USB stick for about $15 and perform some GSM sniffing on a standard laptop running Wireshark. The GSM capture is done using the RTL-SDR and the airprobe tool (which builds on GnuRadio) that relays the packets to Wireshark, via the GSMTAP port (UDP ...


1

Its very possible that your operator inserts a header in outgoing HTTP traffic containing your mobile number, just to allow remote billing, ad targeting, and remote subscription. http://www.htxt.co.za/2014/10/29/vodacom-admits-to-leaking-phone-numbers-to-websites/ Those sites you visit, are those "trusted" sites or are they "random"? If they are random, it ...


0

I think you have an infection. You could confirm that the network is not the issue by testing these things on another network (wifi vs cell, another wifi network, etc.). If it still happens, then it's your phone. If it is an infection, I think a "nuke from orbit" is in order and you should reset your phone. But, that risk/benefit analysis is up to you.


1

No, the purpose of a sniffer is to capture all packets, unless a filter has been applied at capture time. Using a new protocol might mean the data can't automatically be rendered or analysed with more effort, but you will find they are all still saved to the file. All the sniffer is doing is analysing captured data in the same way a router or gateway would ...


1

This all depends on which traffic your interested in. If you want to decrypt the traffic between your client and the device, then it is possible with a proxy. In fact, it is very similar to how Superfish works. See Lenovo Is Breaking HTTPS Security on its Recent Laptops for an outline of how superfish works. On the other hand, if you want to decrypt the ...


3

Take a Look at the FREAK tls vulnerability. you should be able to inject data into the SSL negotiation to trick the device into a RSA Export cipher, and from there the decryption of traffic by a man in the middle is significantly easier ( aka possible. ) Charles is written in java, shouldn't be too hard to modify to exploit this automatically.


42

The entire point of SSL is its resistance to eavesdropping by man-in-the-middle attacks like the one you're proposing. If you cannot make the client device trust your self-signed certificate, then your only options are: Intercept an initial HTTP request and never let the communication be upgraded to HTTPS (this will not work if the site has an HSTS record ...


11

Any suggestions? Is is doable? You need to own a certificate trusted by the device to intercept the traffic. How this can be achieved depends on how proper and open the certificate validation on the device is. The device might have a buggy or non-existing validation of certificates. This is typically No validation at all, in which case you could use ...


3

No. This is the point of SSL, to prevent this kind of unauthorized snooping. To authorize your proxy you need to tell the device to trust the proxy certificate, and tell the device clients to trust your certificate or use the devices private key, which it sounds like you don't have access to. For more information: ...


3

No, the very nature of HTTPS is that the certificate is required to decrypt it. You could sniff the traffic, but it would be encrypted and useless to you.



Top 50 recent answers are included