1

My employer (a Dutch university) gave me an Android phone. I am not allowed to root it. Still I want to know what traffic goes through it. Also I want to protect myself when I am in public places.

First thing I did was to install OpenVPN. Luckily I have a dedicated Linux server running, so I can help others to attain the same. Now I have a secure VPN connection from everywhere.

But still I want to know what traffic is going on. So I installed Whireshark on my server. It sniffs the packets going over my VPN via tshark, part of Whireshark. It is fully working, I get a file with the traffic going on through the OpenVPN interface.

Now here comes the real question: What is my phone really communicating, all packets are encrypted. Is it the OpenVPN encryption, or what?

I got stuck on this, could somebody please enlighten me?

Improve this question
2

First all packages are going through the TLS encrypted VPN. Then all apps could communicate over another encrypted connection (for example https). So these packages are encrypted multiple times.

If you want to sniff, the simplest way doing this is install the sniffer directly on your device and install your own root certificate (this is a high security risk). For example your could use this app https://play.google.com/store/apps/details?id=app.greyshirts.sslcapture (But to sniff TLs connections the app have to install a root certificate on your device!)

Improve this answer
  • So what you're saying is that even if I would hack the OpenVPN encryption, there could still be apps that use their own (additional) encryption. Would that not mean that a sniffer located on the phone itself also only sees encrypted packages? I have tried your solution, and indeed there are unencrypted and encrypted messages. Well, maybe I just want too much. On my OpenVPN server I can see where the traffic is going, so I guess I will have to settle for that. – OldyHawn Jul 12 '16 at 11:54
  • If you sniff on the phone you bypass the VPN. You have understood right that some apps useing a encrypted connection are still not readable. For that you can install your own root certificate and with this you can gernerate a valid (only on this device valid) certificate for any domain. Then you can read all the data send with https. – Julian Jul 12 '16 at 12:24
0

Install BurpSuite tool on your laptop and make it listen to all interfaces. Then you can set your android phone to send all the traffic through BurpSuite.
If you want to see encrypted data too, then install burp CA certificate on your android phone.
This link has all the steps. Portswigger

There might be issues with some of the apps which use SSL channel because of certificate pinning. For that, you need to have a rooted android phone.

Improve this answer
  • I would try this too, but as I said my employer does not allow me to root my phone. Thanks anyway. – OldyHawn Jul 12 '16 at 12:02
  • With the above method, only a few apps won't be accessible. Other than that, you can see http and https traffic through safari/chrome and apps which uses non-ssl – one Jul 12 '16 at 18:00

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.