Re:Decrypting TLS Browser Traffic with Wireshark
by mobiplayer on Friday February 13, 2015 @04:44AM
(#9043593)
Wait a second...
Was the fake cert trusted by your phone? If affirmative, did you manually add the root cert from your fake CA or at least accepted that cert as trusted?
If you didn't explicitly trust that cert and the application didn't complain we're in front of another completely wrong use of SSL.
Re:Decrypting TLS Browser Traffic with Wireshark
by ecesena on Friday February 13, 2015 @12:10PM
(#9045381)
No, not trusted. That's why I was sad. The app failed to verify the certificate chain and silently continued over the (in)secure connection.
Re:Decrypting TLS Browser Traffic with Wireshark
by mdaniel on Thursday February 12, 2015 @11:52PM
(#9042927)
What an amazing and scary tool (maybe those always go together). I now have a much deeper appreciation for why folks are afraid of Starbucks WiFi.
Re:Decrypting TLS Browser Traffic with Wireshark
by notfoss on Friday February 13, 2015 @05:03AM
(#9043639)
Any decent browser will display a certificate error for a Mitm attack. But yes, if you are using other programs/apps over an untrusted network, you can never be sure.
Re:Decrypting TLS Browser Traffic with Wireshark
by ecesena on Friday February 13, 2015 @12:13PM
(#9045401)
It's not actually about the WiFi, secure or not. I was in a WPA2 WiFi. I attacked my phone (at a higher network level), so unless there's an active IDS in place, you can't do much about it.
The issue is not the network, but the way the app continued over an insecure connection.
Another technique that often, sadly, works is the old school man-in-the-middle.
I was recently looking at the api of an app on my phone, using ettercap to arp poison my phone and capture traffic on my laptop. Found the api call was over https (fwd secrecy and all looking good), I tried ssl-mitm with a fake cert... no errors in the app, clear text on my laptop. Happy and sad at the same time. :/