1

I am trying to setup a MitM scenario between an IoT device and WAN. It is possible and quite easy to achieve same thing for the application run on a mobile device by setting my proxy server(Fiddler)'s certificate is trusted.

Since the IoT device that is being tested does not let you to make it consider the certificate as trusted, I am looking for the alternative methods. Is there any way to break in HTTPs connection and see all content as plain-text?

Improve this question
9
  • 1
    Have you attempted to use your proxy server's certificate without altering the target device? It's a common misconfiguration for embedded devices to use SSL but not actually verify the certificate. If you have tried this, please update your question with what you've attempted so far, and what happened when you did.
    – Johnny
    Nov 5, 2018 at 10:48
  • Eavesdrop is easy in the LAN. Decryption is the challenge. SSL does not allow this, so is your question on common vulnerabilities? Also you need to be more specific: are you talking about SSL server-authentication and your IoT device is the client? are you talking about client certificate (for authentication purposes)?
    – papajony
    Nov 5, 2018 at 11:56
  • @Johnny the thing is I also don't know how to use my proxy server's certificate for the IoT device since there is no user interface for it. (There is an Android app and web interface which is accessible when you both connected to same LAN but both have no such feature which lets you to do so)
    – dekemra
    Nov 5, 2018 at 12:53
  • If the certificate is not pinned and you can add a certificate to the client you can use something like Charles Proxy to examine the data.
    – zaph
    Nov 5, 2018 at 12:55
  • @PeterPapadopoulos Well yes, my target is the TLSv1.2 communication between the IoT device and its cloud service. In order to decrypt the https queries and their responses, the device must trust my proxy's certificate somehow isn't it? I am already doing ARP spoof in LAN to be aware of DNS queries and communicated server IPs. However, I am trying to see the content of transmitted data.
    – dekemra
    Nov 5, 2018 at 12:59

2 Answers 2

Reset to default
2

You basically want to break HTTPS.

There are a few ways this could work, but you are mostly relying on mistakes somewhere along the way. This is not an exhaustive list.

  • Device side problems

    • Device might check the certificate is signed by a trusted CA (your MITM proxy can just generate a certificate).
    • Device might check the certificate is signed by a trusted CA, but forgets to check CN (domain name) field, so any valid certificate works.
    • Device allows you to install a custom CA (same as you do on your mobile device).
    • sslstrip type attacks where device initiates connections on HTTP and relies on server to upgrade to HTTPS.
    • Downgrade attacks to less/in-secure encryption.
    • Modifying firmware to work with your certificates.

  • Target domain

    • Private key may be available (probably not, but has been seen before, more common for self-signed certificates).
    • Any compromised or misconfigured CA could be used to generate valid certificates for all domains (trusting all these CAs is the big problem of PKI).
    • Target website or DNS attacks would allow attackers to generate valid certificates.

(Un)fortunately this is quite hard to do when properly configured. If it was easy, there wouldn't be much point to HTTPS.

Improve this answer
-1

Is there any way to break in HTTPs connection and see all content as plain-text?

Definitely yes. There is a way to achieve this but it's not that easy as it sounds. The technique you are searching for is called SSL inspection. It is used at many Firewalls or IDSs/IPSs to intercept a HTTPS connection. First you are establishing a TLS connection with your IoT device. If it wants to connect to a Server, the request is sent to your PC and decrypts it. Afterwards you encrypt it again and redirect it to the requested server. For your understanding I got this Image: enter image description here The firewall in this image shows your PC.

If you now want to try this in your network you can use SSL Strip. I think this will work for you.

Improve this answer
9
  • 3
    It is not that simple. The Firewall will have to supply a certificate to the client the client will accept as valid. This is usually achieved by adding a certificate to the client computer. If the client is pinning the certificate (verifying that the certificate presented is for the correct server) the client will reject the firewall supplied certificate.
    – zaph
    Nov 5, 2018 at 12:52
  • 1
    Thats why i wrote "it's not that easy". His question was if there is a way. I explained it generally and appended some infos where he can find more information how he can do it.
    – Cyberduck
    Nov 5, 2018 at 14:07
  • @CDRohling Then the simple answer is "Yes". Or a more full answer.
    – zaph
    Nov 5, 2018 at 15:46
  • @CDRohling Does HSTS prevent such attack?
    – dekemra
    Nov 7, 2018 at 12:55
  • 1
    @CDRohling you have put different names and an image to the question, but you have not answered it. How do you make "SSL inspection" (or Fiddler) work with an IoT device? "Put in between a magical box" is not the answer.
    – domen
    Jan 5, 2019 at 18:40

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .