Information Security Stack Exchange is a question and answer site for information security professionals. It only takes a minute to sign up.
Sign up to join this community
I watched a documentary where hackers entered a victim's house by pretending to be from the ISP and then connected a box to a router in order to spy on all of the victim's traffic. Later, the hackers retrieved many passwords, e.g., iCloud and Gmail passwords. What is that box called?
I was surprised that it was so easy to do as all traffic was normally encrypted. How did they do that?
Unfortunately is not clear what exactly was shown there, we have only your description of it. This description might lack important details they have shown or they might have omitted these details in order to "simplify" it and/or make it sound more dangerous in order to increase attention and clicks. So we can only speculate what might have happened here due to a lack of details, which is not a good base for an answer. But lets speculate ...
What you describe was maybe an active MITM attack against HTTPS connection to "break" encryption combined with traffic analysis to extract passwords from the traffic. No special magic box is needed to do this, freely available software is sufficient. But there are things like WiFi Pinapple which come preconfigured to make such attacks simpler.
An active MITM attack can be used to "break" encryption and sniff passwords. It does this by intercepting and modifying the traffic. Instead of creating the intended direct end-to-end encrypted encryption between client and server, which is authenticated by the servers certificate, it will create a HTTPS connection between server and attacker and another one between attacker and client. This will allow the man in the middle attacker to get access to the plain traffic.
But the HTTPS connection between attacker and client cannot be authenticated using the original certificate of the server, since the attacker does not have the servers private key. The attacker thus needs to create a new certificate for this. This means that such an attack is not a silent when certificates are properly checked (which they usually are today): when accessing the site with the browser the victim will get a warning that someone is fiddling with the connection and has explicitly to skip this warning. Skipping is often not even possible due to HSTS.
That is at least the case unless somebody has specifically prepared the victim system in order to accept the attacker certificates instead of the real certificate from the server - but this would require access to the victims systems before doing the attack. Or the victims system came with broken certificates preinstalled like in case of the Superfish CA certificate on Lenove Laptops.
For more in this see Does https prevent man in the middle attacks by proxy server? and Did HTTPS and HSTS kill MITM?.
The box was used to perform a man-in-the-middle attack. It was grabbing information and passing it on, including the encryption keys for the https traffic. Once it had the keys it could sniff all the traffic and keep the useful bits for later.
