-5

There is an underage guest in my house for whom I will be legally responsible for the next few months and I'm concerned about some of his interactions online from some of the public postings I've seen on various Instagram accounts and other activities I've picked up. I want to gather information and validate my suspicions before confronting him.

I want to monitor all traffic that goes to his phone and computer. It's been a long while since my ethical hacking classes. How can I sniff his https traffic? Things like Instagram (most concerned about) along with Apple iMessage and such. I know about Wireshark and such but my current switch isn't allowing me to forward all traffic to my PC (and it needs to get upgraded anyway) so I'm replacing it with ubiquity. (I chose this for single vendor networking and video surveillance).

I know he is communicating through direct messaging, but I want to sniff those and see the contents of the messages. I just want to gather a few things before I confront him.

Which technique would be better for this? Would simple packet sniffing be enough, or would I need to execute some man in the middle techniques to be skirt around the x.509 protocols?

I know that the ubiquity gear has some nice DPI, but I'm really interested in the contents. Is there something in that gear that will assist with this. Can I use the USG as a proxy server?

  • 2
    It is impossible that you will be able to monitor the payload of TLS traffic without having a CA trusted by the user - which means that you would need to install such a CA at the system(s) of the guest. And even then you'll likely will not be able to monitor everything since some not every encryption is using TLS. At most you can get with non-intrusive (i.e. passive) monitoring is the contents of plain text traffic and meta data like domain names of encrypted traffic. Even then I doubt that this is legal and ethical w/o that at least the parents of the underage guest agree. – Steffen Ullrich Apr 18 at 18:56
  • I have sat and talked with him. He has given me his phone to look through and everything. But I also don't think he is being completely honest and I've found new accounts he's created recently. I also no he will say one thing but be doing another. I've talked with him I just want to gather evidence to either validate his claims or to validate my gut feeling. – xtreampb Apr 18 at 19:06
  • also the things that i'm concerned about may be felony offenses such as money laundering and gang activity. so lets not question my morals just yet – xtreampb Apr 18 at 19:07
  • Mitm proxy tool is probably what you are looking for.You will also have to install a root ca certificate.Google it for rest of the details – Vipul Nair Apr 18 at 19:18
  • EVERYONE: please, the ethics and legality are not clear cut in this situation. So please leave the judgemental comments uncommented. – schroeder Apr 18 at 20:48
3

Unfortunately, you have 2 issues here:

  1. a familial/guardian of a minor issue, and
  2. SSL inspection

Monitoring the household internet is not uncommon, but the ethics are questionable. The fact that you want to do this for a very specific purpose is what is getting everyone concerned. That part we cannot help you with.

The technique you need for the technical issue is to break SSL and inspect the traffic. This is not a small ask. It will break SSL for everyone in the house, and all devices will need to install a TLS certificate that you will need to create and maintain. You will then need to collect the packets from the device you want to target in order to inspect.

And the child can simply use another network once they know you are inspecting their traffic (like the mobile network or free public wifi).

Frankly, you do not have enough time or resources to do this in a home situation. To accomplish your familial issue, the solution is not going to be a technical one.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.