1

I am looking at the theory behind MITM attacks in order to see some unencrypted packets from the 3DS. From research here is what I understand so far:

3DS > Proxy > Nintendo server

I am going to try and force the 3DS to use a forged certificate. The 3DS will then communicate with the proxy and the proxy will decrypt the packets, see whats there, re-encrypt them and then send it out to the Nintendo server. I see an issue though, the Nintendo server is expecting to see the original 3DS public certificate from the proxy server but it wont as I do not have it. Is it possible for me to get the original certificate from the 3DS before giving it the forged one?

Here is my idea:

  1. start send packets from 3ds, original cert is sent from 3ds to proxy, which is stored
  2. insert forged cert to 3ds
  3. connection is reset

  1. using forged cert, start communication, fake cert speaks with proxy server
  2. proxy decrypts packets from 3ds, logs them, re-encrypts them
  3. uses the old certificate to communicate with the Nintendo server then forward packets

Is this feasible. Is there an easier way? I know some of them are hard (insert forged cert to 3DS). Which tools can help me accomplish this?

  • "the Nintendo server is expecting to see the original 3DS public certificate" Does the 3DS connection use mutual authentication? If not, the server's public key is public, and the server normally should give it to you (assuming you're using TLS; maybe you're not?). – apsillers Dec 1 '14 at 15:06
  • I think I have misunderstood :) Yes, TLS is being used. So the Nintendo server could issue a certificate to me. But what will it check against to ensure I am a legitimate 3DS? – SBloggs Dec 1 '14 at 15:42
  • "what will [the server] check to ensure I am a legitimate 3DS?" By definition, if the 3DS doesn't use TLS mutual authentication, the server does not validate the client. If the server does validate the identity of the client, then you are using mutual authentication. Without mutual authn, it's still possible to make the messages only usable by a 3DS by, e.g., transmitting messages in a proprietary binary format, or only transmitting encrypted data, decrypted by a secret decryption key printed into the 3DS hardware. – apsillers Dec 1 '14 at 20:11
  • The Miiverse client has a client certificate that Olive (my name for the Miiverse servers, from olv, the internal name) verifies, that's a no-go. Fairly sure this'll hold true for things like the eShop, etcetera. – Austin Burk Mar 6 '15 at 18:22
2

This may or may not even be possible depending on what checks Nintendo does. If Nintendo only trusts their own certificate, signed by them, then you will be unable to make a key pair for the proxy that your DS will trust.

Normal SSL/TLS MITM proxies require that the client trust the certificate used by the proxy as a root cert, that way the proxy can make "valid" certificates on the fly. If you can't push that trust and the client actually checks trust, then your proxy will fail to be accepted as the server and the communication will not occur.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.