1

I need to monitor internet traffic from some smartphones (they want me to monitor them), and I am trying to determine what would be the best setup for my requirements.

I was thinking that what I need is something like creating a VPN service, but I am very new on this field, so I don't know if learning/creating that service is worth it (I am checking openvpn right now).

On the other hand I do know how to use direct proxies, and I setup a very simple example with hoxy and I made a request like:

curl -x my.server.com:port http://httpbin.org/ip

and it did worked, and I was even able to modify the request and response from my hoxy script. The problem came when I tried to do a https request which didn't allow the proxy to work (I think I need to create a self-signed certificate? This would the first time I also try this). The problem with this approach would be how to setup the certificate and also how to configure the smartphone to actually use that (maybe it is the same as a VPN and I am not understanding it correctly).

So what do you think would be the best approach here, assuming that these smartphones can give me all the authority for monitoring them

1
  • still trying stuff out
    – eLRuLL
    Commented Dec 15, 2018 at 18:14

2 Answers 2

2

What you require ranges from the easy (for unencrypted traffic), to the difficult (general TLS traffic), to the impossible (TLS traffic + pinning).

  • Unencrypted traffic you can just monitor with a simple gateway or proxy the mobile devices have to use for internet traffic.
  • General TLS encrypted traffic can be monitored by a MITM technique. For this you need to set up a trusted TLS proxy, that establishes the TLS connection for the device. This is a non-trivial task with plenty of security implications.
  • If the devices use TLS + certificate pinning you're out of luck. In this case the device expects a specific, hard-coded certificate, and unless it gets exactly what it wants, no connection will be established. This is the case, for example, for connections of iOS devices to Apple's App Store.
1
  • thanks for the answer, I am still trying stuff out btw.
    – eLRuLL
    Commented Dec 15, 2018 at 18:13
3

That is exactly the problem you're running into. You cannot decrypt HTTPS traffic without having a Trusted CA installed on the phone, and the security implications of being able to do so easily would not be pretty.

I decrypt traffic in certain OUs, but phones still get domains blocked. It's not the control you're probably hoping for, but it is what it is.

1
  • So if I installed that certificate on the phone, would there be a problem? Remember that this isn’t something illegal I want to do. Thing that these are my phones and I don’t care about security on those phones
    – eLRuLL
    Commented Dec 4, 2017 at 13:27

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .