Super User is a question and answer site for computer enthusiasts and power users. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have this device connected to my home network, and I'm curious about what it's sending to the Internet. It seems to generate a lot of traffic.

I've connected it to my laptop and I've shared the connection by using the Network Manager option in Ubuntu. Then, I tried to see the network traffic with Wireshark.

It seems to send all data to an external server hidden in the post using HTTPS. That's it? There's nothing I can do?

The destination server has a self-signed certificate, but probably the device has this one certificate as accepted. Could I replicate this certificate if needed?

I tried to redirect all the traffic to a local server with this iptables rule, but I'm probably missing something. It doesn't seem to work. I don't even get an entry on my Apache log (and yes, it's actually listening on port 443):

iptables -t nat -I PREROUTING --src --dst 81.91.XX.XX -p tcp --dport 443 -j DNAT --to-destination

And this is the output from Wireshark when I do that:

Wireshark screenshot when doing the iptables thingy

It seems the connection can't be stablished. But shouldn't my Apache react and write a log entry at least? What am I doing wrong? Is this a good approach or should I try other things?

(Please notice I've hidden the full destination IP on both the rule and the screenshot)

share|improve this question

migrated from Apr 6 '14 at 7:41

This question came from our site for system and network administrators.

up vote 1 down vote accepted

You can't replicate the SSL Certificate - if its being validated you are stuffed with respect of sniffing the traffic between the device and the server - but its possible that its not being validated.

Depending on whether (how) the device validates the server its sending to, you might be able to do a man-in-the-middle attack on the HTTPS data. You may be able to do something like this with SSLSplit on the router. (Hopefully this will fail if its properly validating the SSL connection, but you may get lucky).

Also, in the very unlikely event your device can support a proxy server you may be able to force it through a local proxy server which will intercept the traffic. (I can't find much information on the device - which is a pity)

share|improve this answer
I'm feeling lucky. It seems the device isn't checking anything... er... hopefully? At least that let me sniff the data. Thank you! – Jorge Suárez de Lis Apr 9 '14 at 22:57
Another thing (since this post was written) - If you act quickly, you might find the server is vulnerable to Heatbleed and you can use it as an opportunity to get the private key of the server for interception purposes !!! – davidgo Apr 10 '14 at 2:19

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .