Skip to main content
added 20 characters in body
Source Link
GxTruth
  • 953
  • 6
  • 9

Using an HTTPS Proxy relies on the fact that you can MitM the connection by using a self-signed certificate. Effectively you can create a certificate for "*.ea.com" issued by your own CA and tell the HTTPS proxy to send it to your game, in case it tries to establish an outbound connection.

This is the normal process:

  1. Game wants to contact ea.com
  2. Performs a TLS handshake with ea.com
  3. Receives a certificate saying "this public key belongs to ea.com"
  4. Game determines whether the certificate is authentic and trusted
  5. If no, terminate connection, otherwise send encrypted data which can only be decrypted by the owner of the private key

As soon as the game encrypts the data, you cannot decrypt it, even if you use Wireshark. Using a proxy which breaks HTTPS does this:

  1. Game wants to contact ea.com
  2. Tries to perform TLS handshake with ea.com
  3. HTTPS proxy establishes the connection to ea.com itself instead
  4. HTTPS proxy gives the self-signed certificate (which YOU have the private key for) to the game
  5. All traffic is now decrypted and re-encrypted in the HTTPS proxy using the self-signed certificate
  6. Game determines whether the certificate is authentic and trusted
  7. If no, terminate connection, otherwise send encrypted data which can only be decrypted by the owner of the private key (which is YOU in this case)

Step 5 is problematic. An HTTPS proxy only works if the game relies on the OS to determine the authenticity of a certificate. In this case, you can locally install your self-signed cert and the OS happily tells the game "yup, everything is fine". If the game does some sort of HSTS-like and certificate pinning technique to avoid fake-certificates and insist on an original on (or even stores the only accepted (root)certificate locally in its code), you cannot trick it in accepting a self-signed certificate (without messing with the game's code itself).

I assume this is the reason for your HTTPS proxy failing to replace the original certificate with a fake one. Your proxy does either not pick it up, as it cannot reveal the plain text or pick it up without being able to decrypt it.

Using an HTTPS Proxy relies on the fact that you can MitM the connection by using a self-signed certificate. Effectively you can create a certificate for "*.ea.com" issued by your own CA and tell the HTTPS proxy to send it to your game, in case it tries to establish an outbound connection.

This is the normal process:

  1. Game wants to contact ea.com
  2. Performs a TLS handshake with ea.com
  3. Receives a certificate saying "this public key belongs to ea.com"
  4. Game determines whether the certificate is authentic and trusted
  5. If no, terminate connection, otherwise send encrypted data which can only be decrypted by the owner of the private key

As soon as the game encrypts the data, you cannot decrypt it, even if you use Wireshark. Using a proxy which breaks HTTPS does this:

  1. Game wants to contact ea.com
  2. Tries to perform TLS handshake with ea.com
  3. HTTPS proxy establishes the connection to ea.com itself instead
  4. HTTPS proxy gives the self-signed certificate (which YOU have the private key for) to the game
  5. All traffic is now decrypted and re-encrypted in the HTTPS proxy using the self-signed certificate
  6. Game determines whether the certificate is authentic and trusted
  7. If no, terminate connection, otherwise send encrypted data which can only be decrypted by the owner of the private key (which is YOU in this case)

Step 5 is problematic. An HTTPS proxy only works if the game relies on the OS to determine the authenticity of a certificate. In this case, you can locally install your self-signed cert and the OS happily tells the game "yup, everything is fine". If the game does some sort of HSTS-like technique to avoid fake-certificates and insist on an original on (or even stores the only accepted (root)certificate locally in its code), you cannot trick it in accepting a self-signed certificate (without messing with the game's code itself).

I assume this is the reason for your HTTPS proxy failing to replace the original certificate with a fake one. Your proxy does either not pick it up, as it cannot reveal the plain text or pick it up without being able to decrypt it.

Using an HTTPS Proxy relies on the fact that you can MitM the connection by using a self-signed certificate. Effectively you can create a certificate for "*.ea.com" issued by your own CA and tell the HTTPS proxy to send it to your game, in case it tries to establish an outbound connection.

This is the normal process:

  1. Game wants to contact ea.com
  2. Performs a TLS handshake with ea.com
  3. Receives a certificate saying "this public key belongs to ea.com"
  4. Game determines whether the certificate is authentic and trusted
  5. If no, terminate connection, otherwise send encrypted data which can only be decrypted by the owner of the private key

As soon as the game encrypts the data, you cannot decrypt it, even if you use Wireshark. Using a proxy which breaks HTTPS does this:

  1. Game wants to contact ea.com
  2. Tries to perform TLS handshake with ea.com
  3. HTTPS proxy establishes the connection to ea.com itself instead
  4. HTTPS proxy gives the self-signed certificate (which YOU have the private key for) to the game
  5. All traffic is now decrypted and re-encrypted in the HTTPS proxy using the self-signed certificate
  6. Game determines whether the certificate is authentic and trusted
  7. If no, terminate connection, otherwise send encrypted data which can only be decrypted by the owner of the private key (which is YOU in this case)

Step 5 is problematic. An HTTPS proxy only works if the game relies on the OS to determine the authenticity of a certificate. In this case, you can locally install your self-signed cert and the OS happily tells the game "yup, everything is fine". If the game does some sort of HSTS- and certificate pinning technique to avoid fake-certificates and insist on an original on (or even stores the only accepted (root)certificate locally in its code), you cannot trick it in accepting a self-signed certificate (without messing with the game's code itself).

I assume this is the reason for your HTTPS proxy failing to replace the original certificate with a fake one. Your proxy does either not pick it up, as it cannot reveal the plain text or pick it up without being able to decrypt it.

Source Link
GxTruth
  • 953
  • 6
  • 9

Using an HTTPS Proxy relies on the fact that you can MitM the connection by using a self-signed certificate. Effectively you can create a certificate for "*.ea.com" issued by your own CA and tell the HTTPS proxy to send it to your game, in case it tries to establish an outbound connection.

This is the normal process:

  1. Game wants to contact ea.com
  2. Performs a TLS handshake with ea.com
  3. Receives a certificate saying "this public key belongs to ea.com"
  4. Game determines whether the certificate is authentic and trusted
  5. If no, terminate connection, otherwise send encrypted data which can only be decrypted by the owner of the private key

As soon as the game encrypts the data, you cannot decrypt it, even if you use Wireshark. Using a proxy which breaks HTTPS does this:

  1. Game wants to contact ea.com
  2. Tries to perform TLS handshake with ea.com
  3. HTTPS proxy establishes the connection to ea.com itself instead
  4. HTTPS proxy gives the self-signed certificate (which YOU have the private key for) to the game
  5. All traffic is now decrypted and re-encrypted in the HTTPS proxy using the self-signed certificate
  6. Game determines whether the certificate is authentic and trusted
  7. If no, terminate connection, otherwise send encrypted data which can only be decrypted by the owner of the private key (which is YOU in this case)

Step 5 is problematic. An HTTPS proxy only works if the game relies on the OS to determine the authenticity of a certificate. In this case, you can locally install your self-signed cert and the OS happily tells the game "yup, everything is fine". If the game does some sort of HSTS-like technique to avoid fake-certificates and insist on an original on (or even stores the only accepted (root)certificate locally in its code), you cannot trick it in accepting a self-signed certificate (without messing with the game's code itself).

I assume this is the reason for your HTTPS proxy failing to replace the original certificate with a fake one. Your proxy does either not pick it up, as it cannot reveal the plain text or pick it up without being able to decrypt it.