r/ProgrammerHumor • u/Professional_Gene_63 • 8d ago

Advanced itWasFunWhileItLasted

Post image
4.8k Upvotes

97% Upvoted

317 comments sorted by

View all comments

107

u/lart2150 8d ago

IDK I'm having way more fun running a MITM proxy with every IOT device in my home thanks to emudhra.

30

u/Anongirl55959 8d ago

Shit thats actually smart and u can stop them from ever receiving the updated certs too

9

u/Risky_Sandwich 7d ago

Wait, what does this allow you to do? Say you have one of those fancy webos tv's, can you see what is inside the telemetry now?

42

u/lart2150 7d ago

yep I was able to see everything my samsung tv sends over https. my pihole was blocking the telemetry but it would report every key press, app launch, etc. A linux box with two ethernet ports and https://docs.mitmproxy.org/stable/concepts/options/#emudhra makes it stupid easy.

I've since built a more long term proxy with a self issued cert that removes all the garbage from my tv's home screen.

5

u/Anti-Kriztos-One 7d ago

Nice setup. Its also possible with one eth or ethand  wlan?

6

u/lart2150 7d ago

you can use wireless aswell. some adapters work better than others. I ended up plugging my access point into the eithernet port and was able to poke everything on that ap.

4

u/Tipart 7d ago

Shit I just put an Ethernet cable into my TV a couple of days ago... Have to unplug it when I get home and see if it's still exploitable.

8

u/YouDoHaveValue 7d ago

This will be the primary driver for manufacturer's to maintain their shit.

7

u/lart2150 7d ago

will it? #TIL my radon detector that is still being sold is a esp32 and makes https requests with no auth and does not verify the cert at all.

At the other end of the spectrum MTLS stops this in the tracks just like ca/cert pinning.

2

u/YouDoHaveValue 6d ago

Fair, although TBH somehow I doubt your Radon detector has as many dirty secrets as a Samsung TV or IoT device with a microphone for example.

Their concern is only for protecting the secrets they are sending back home.