TLS1.2 Decryption / Interception of MQTT IoT device.

I have an IoT Smart Device Bridge that is communicating to an AWS IoT service using TLS1.2

I’ve decompiled the APK file of the application communicating through to AWS (and indirectly to my device) and can see the MQTT topics an example of some are:

public enum Event {

InstantDemand(“metering/instantaneous_demand”),

MinuteSummation(“metering/summation/minute”),

Additionally I found a string in the android APK file called MQTT_CERT_PW that has what looks like a mutli-character password of some sort.

Also

MQTT_ENV with the ats.iot.us AWS server

HIVE_MQTT_BROKER with a different mqtt server listed.

I have a port mirroring device inserted between the Bridge, capturing the packets. But as expected they are all TLS1.2 encrypted, although Wireshark tags the encrypted communications as MQTT protocol.

I don’t have SSH credentials for the device, although it answers on Port 22.

I’ve looked up some utilities such as SSLStrip, but I haven’t tried anything like that yet, and I’m assuming it wouldn’t work, as most of the tutorials are for HTTPS webpages.

Next steps are what?

submitted by /u/nairdaswollaf
[link] [comments]

September 29, 2023
Read More >>