Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

I have this device connected to my home network, and I'm curious about what it's sending to the Internet. It seems to generate a lot of traffic.

I've connected it to my laptop and I've shared the connection by using the Network Manager option in Ubuntu. Then, I tried to see the network traffic with Wireshark.

It seems to send all data to an external server hidden in the post using HTTPS. That's it? There's nothing I can do?

The destination server has a self-signed certificate, but probably the device has this one certificate as accepted. Could I replicate this certificate if needed?

I tried to redirect all the traffic to a local server with this iptables rule, but I'm probably missing something. It doesn't seem to work. I don't even get an entry on my Apache log (and yes, it's actually listening on port 443):

iptables -t nat -I PREROUTING --src 10.42.0.73 --dst 81.91.XX.XX -p tcp --dport 443 -j DNAT --to-destination 127.0.0.1:443

And this is the output from Wireshark when I do that:

Wireshark screenshot when doing the iptables thingy

It seems the connection can't be stablished. But shouldn't my Apache react and write a log entry at least? What am I doing wrong? Is this a good approach or should I try other things?

(Please notice I've hidden the full destination IP on both the rule and the screenshot)

share|improve this question

migrated from serverfault.com Apr 6 at 7:41

This question came from our site for professional system and network administrators.

1 Answer 1

up vote 1 down vote accepted

You can't replicate the SSL Certificate - if its being validated you are stuffed with respect of sniffing the traffic between the device and the server - but its possible that its not being validated.

Depending on whether (how) the device validates the server its sending to, you might be able to do a man-in-the-middle attack on the HTTPS data. You may be able to do something like this with SSLSplit on the router. (Hopefully this will fail if its properly validating the SSL connection, but you may get lucky).

Also, in the very unlikely event your device can support a proxy server you may be able to force it through a local proxy server which will intercept the traffic. (I can't find much information on the device - which is a pity)

share|improve this answer
    
I'm feeling lucky. It seems the device isn't checking anything... er... hopefully? At least that let me sniff the data. Thank you! –  Jorge Suárez de Lis Apr 9 at 22:57
    
Another thing (since this post was written) - If you act quickly, you might find the server is vulnerable to Heatbleed and you can use it as an opportunity to get the private key of the server for interception purposes !!! –  davidgo Apr 10 at 2:19

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.