2

Problem: I have a local machine (IoT, lets call it MCC) which connects via SSL to a website (mcc.com) to get some JSON data. I would like to send modified JSON from my own server.

Idea: Setup a local device (lets call is rasp) which opens a wifi hotspot. The MCC should then connect to the rasp. The rasp answers with a certificate from the public server mcc.com, but sends the modified JSON data.

I am not familiar with DNS, but I expect this to be difficult as we do not own the public key of mcc.com. Does someone know some solution here? The MCC does not use some kind of DNS over https.

2 Answers 2

1

Idea: Setup a local device (lets call is rasp) which opens a wifi hotspot. The MCC should then connect to the rasp. The rasp answers with a certificate from the public server mcc.com, but sends the modified JSON data.

Your host rasp cannot impersonate mcc.com by providing the same public key. You would need the server's private key to do this. Therefore, if there's any checks on your IoT device towards verifying the TLS endpoint is valid (validates against a CA or uses certificate pinning), your idea will fail. Otherwise it might just work regardless of you using your own certificate on the fake server.

DNS is easy to tamper with since you control the local network and, as I understand it, traditional basic DNS is used. Ultimately you don't even need to touch DNS, you just need to intercept the TLS request and forward it to your own server.

0

In order to come up with a solution, I guess that you have to regard 2 protocols separately: One being DNS and the other being TLS:

Here are the steps that currently happen when you get your JSON from https://mcc.com/whatever-your-full-path-is :
- your client queries DNS for the A record of mcc.com and gets an IP in return
- your client sends the HTTPS request to the IP that DNS returned

Under the assumption that you have administrative access to the client that you call MCC, one easy way to spoof the DNS is to create an entry in the client's hosts file (/etc/hosts on Linux or \windows\system32\drivers\etc\hosts on Windows) that would point mcc.com to the IP of the rasp device.

To circumvent the TLS issue, you might create a self-signed certificate (see openssl documentation) for mcc.com and have the web server on rasp use it.
In order to prevent certificate validation errors on your client, you may import that new certificate to the root CAs of your client.

In case that you do not have administrative access to the client (MCC), things become tricky:
You can set up a MITM proxy on your rasp (and have it provide its self-signed certificate to MCC), however the certificate validation on MCC will most likely spit out error messages because the certificate is not trusted.

1
  • If rasp is a DNS server, that can be used to change the DNS entry as well. Jun 3, 2020 at 15:26

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.