News for hackers. Stuff that matters.

A comment on Due to a problem with AWS, many "smart" vacuums or doorbells will stop working. Parent comment

Re:Due to a problem with AWS, many "smart" vacuums or doorbe... by TedDoesntTalk on Thursday November 26, 2020 @10:19PM (#25225301)
Our fucking community pool has an app to unlock the gate. Why do I need to install your app to open a gate?

I refused to install it and demanded a keycard. People look at me like I’m a freak when I open the door with it.

[ Parent | on HN ]
Re:Due to a problem with AWS, many "smart" vacuums or doorbe... by skeletonjelly on Thursday November 26, 2020 @11:37PM (#25225580)
You should intercept the API calls it uses!
[ Parent | on HN ]
Re:Due to a problem with AWS, many "smart" vacuums or doorbe... by fakedang on Friday November 27, 2020 @01:50AM (#25226121)
Honest question. How do you intercept and retrieve an API that communicates within an app?
[ Parent | on HN ]
Re:Due to a problem with AWS, many "smart" vacuums or doorbe... by rl1987 on Friday November 27, 2020 @06:47AM (#25227867)
Assuming it does not use TLS cert pinning, you can use mitmproxy [0].

[0] https://mitmproxy.org/

[ Parent | on HN ]
Re:Due to a problem with AWS, many "smart" vacuums or doorbe... by nickserv on Friday November 27, 2020 @02:51AM (#25226405)
If it's on WiFi, any old packet sniffer on the network should do the job. If it's on cellular, you'll need to have access to police equipment.
[ Parent | on HN ]
Re:Due to a problem with AWS, many "smart" vacuums or doorbe... by ThermalCube on Friday November 27, 2020 @03:32AM (#25226605)
Cellular data? just connect your phone to your own VPN (like a RaspPi) and sniff there
[ Parent | on HN ]
Re:Due to a problem with AWS, many "smart" vacuums or doorbe... by tpetry on Friday November 27, 2020 @04:31AM (#25226955)
A packet sniffer on the network will not help with tls encrypted endpoints.

The charles proxy with custom ssl certificates may help if the certificate is not pinned in the app.

[ Parent | on HN ]
Re:Due to a problem with AWS, many "smart" vacuums or doorbe... by TeMPOraL on Friday November 27, 2020 @05:46AM (#25227481)
I'm going to bet a beer it's not encrypted at all. Too much hassle, so plenty of hardware vendors don't bother.
[ Parent | on HN ]
Re:Due to a problem with AWS, many "smart" vacuums or doorbe... by tpetry on Saturday November 28, 2020 @09:38AM (#25237750)
With everyone putting their services behind cliudflare or aws loadbalancer you very seldom see a http endpoint nowadays.
[ Parent | on HN ]
Re:Due to a problem with AWS, many "smart" vacuums or doorbe... by nezgar on Friday November 27, 2020 @09:56AM (#25229143)
HTTPS MITM + Wireshark If it even uses HTTPS lol
[ Parent | on HN ]
Re:Due to a problem with AWS, many "smart" vacuums or doorbe... by jeofken on Saturday November 28, 2020 @05:32PM (#25241112)
Wireshark is popular for this
[ Parent | on HN ]