3

I am trying to monitor the traffic of some "smart devices" in my home (TV, coffee machine, ...) but most of them communicate over SSL.

What possibilities are there to look into SSL encrypted traffic without paying a lot of money for some appliances?

I do have the possibility to import my own certificates in some of the smart devices but I don't know how to handle all this in a somehow useful way. I even have a little Intel NUC between my ISPs router and the switch used for these smart devices, so I could use this one for SSL stripping - I am just not sure how to start with it.

Any advice would be highly appreciated.

1
  • 1
    I would prefer the term "SSL decryption" over "SSL stripping". SSL stripping is just replacing https with http in links of plaintext traffic.
    – Noir
    Aug 29, 2015 at 15:54

2 Answers 2

4

If I am not mistaken, importing your own SSL certificates is just for the connections which you make to the device's own web interface so that won't help you to accomplish your goal.

What you would need to do is:

  1. Create your own root CA
  2. Make those devices trust your own root certificate
  3. Redirect all SSL traffic from those devices to your proxy
  4. When a device tries to connect to spy.samsung.com present an SSL certificate for spy.samsung.com signed with your own root certificate.
  5. Forward requests to real spy.samsung.com and replies back to the device.

The hardest part is #2, which requires access to the device on a level which will allow you to modify its trusted certificate store.

The complexity of that task may range from trivial, such as logging in through SSH and appending your root certificate to curl-ca-bundle.crt or a similarily named file somewhere on the device, to the extremely difficult, such as having to defeat boot-loader lock and code-signing verification to patch an executable in the device's firmware so you can insert your root certificate or even having to find and extract its private key if the device is using mutual authentication with the server.

Depending on your place of residence some of those activites (such as reverse-engineering the device) might even be illegal, not to mention that if you already have to resort to reverse-engineering you might as well look at the code to see what is being sent/received.

2
  • 1
    If you are lucky, the communication is badly implemented and accepts self signed certificates. Have a look at mitmproxy.
    – Noir
    Aug 29, 2015 at 16:02
  • 1
    +1 for spy.samsung.com - a little too realistic.
    – Nic Barker
    Aug 30, 2015 at 0:42
0

You can use your computer as a proxy server using "Squid" and configure SSL dump by decrypting the traffic, analyze it and re-encrypting it again and send it to its destinations. You will have to import the certificate created by Squid to your connected devices.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .