1

Currently I have a raspberry pi connected to my home security system. I have written a Python daemon running a HTTP server (very insecure I know, but this is still under construction) so I can send it POST requests to arm my alarm. I'm trying to also add disarm alarm functionality, which of course requires much more security than the arm command.

I have seen some guides wrapping the server socket with ssl.wrap_socket and providing a self-signed certificate and key file. My question is, if some hacker manages to connect to my WiFi network and sniff my traffic, will he be able to "record" my disarm requests and send it himself (I think it's called a replay attack?) Or is HTTPS totally encrypted so that all he can see is gibberish.

I'm planning on writing an Android application as the client to send the disarm REST requests locally. Are special configurations required on the client-side to fully take advantage of HTTPS?

|improve this question
  • 2
    If you use SSL/TLS correctly, a attacker will not be able to see traffic between you and your program. TLS encrypts the whole lot. I would place much more worry in the fact that you have connected your alarm system to a http server. – pm1391 Feb 6 '18 at 3:08
  • taking a simple naive system and adding https should result in something decent. it's that simple. – dandavis Feb 6 '18 at 4:06
  • You can also have all the encryption in the world but if your authentication mechanisms are terrible... – pm1391 Feb 6 '18 at 4:53
1

I'm assuming you can only send this HTTP through the internal Wifi network...? A hacker would have to breech your network (this should be your #1 concern) and understand you arming your alarm with http commands which will not be something they are directly looking for (if an anonymous hacker). If that happens you're in trouble... but if a hacker can remotely access your home network you're in trouble. How are you routing your http commands? If you are sending them from the "internet" into your router by initiating an http connection externally... -that is a serious problem-. At the very least it is bad practice, imo.

To give a clear answer: either way it's worth using some protections. Https/tls is fine. Oauth is another option. I would not allow the saftey of my family to be associated with something that is vulnerable to a simple replay attack.

Here is a great, condensed, article on Rest Security. https://www.owasp.org/index.php/REST_Security_Cheat_Sheet

|improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.