mitmproxy adds --emudhra option

 (github.com)

124 points | by ahlCVA 1 hour ago

13 comments

  • Confiks 14 minutes ago
    It's almost a shame it includes the private key and doesn't bruteforce it in-band for every request.
  • lambda 2 minutes ago
    Oh, nice. I was thinking of setting up a proxy for this for testing, nice to just have it working out of the box.
  • shrubble 56 minutes ago
    If I’m understanding correctly, you could sniff the communication between your Smart TV and the manufacturer using this method?
    [-]
    • the_snooze 37 minutes ago
      As long as the smart TV still trusts eMudhra, then yeah. You'll want to super careful and prevent the TV from pulling updates that could revoke that trust.
    • kevin_nisbet 47 minutes ago
      Possibly. But some manufacturers may not have the full set of roots, use a private authority, or do certificate pinning.
    • quotemstr 49 minutes ago
      If the TV isn't older than a few years, if it's not checking CRLs, and if it hasn't yet patched itself.
  • seniorsassycat 49 minutes ago
    How much of a boon is this for jailbreaking, reverse engineering, and mitm really?
    [-]
    • bryancoxwell 9 minutes ago
      Been wondering this as well. I also don’t really understand the mitm to jailbreak pipeline
      [-]
      • flexagoon 1 minute ago
        Some smart devices pull config files from a server. By mitming that, you can change the config to enable some sort of developer mode on the device.
      • qwertyforce 1 minute ago
        Maybe intercept firmware update and then reverse engineer it and find rce?
  • tecleandor 1 hour ago
    This is gonna be great to sniff apps in a couple older Android phones I have around. Hope they're not pinning certificates.
  • wildmXranat 39 minutes ago
    Someone should've coined this disaster as "QuattroFail" to give it a little panache and international mystery
    [-]
    • gnabgib 33 minutes ago
      "4" was only some of the keys (they were all <256).. ByteFail seems more accurate
  • mintflow 27 minutes ago
    Haha, this is quite interesting to test if you need to update various of program (if they do not use the sys ca chain)
  • deadbabe 7 minutes ago
    Can someone explain the significance here, a lot has happened in 24 hours.
    [-]
    • Gigachad 3 minutes ago
      An Indian Certificate Authority was found to have a private key that’s literally the number 4. So using that you can sign valid https certs for anything that isn’t checking the revoked list.
  • 0xbadcafebee 10 minutes ago
    [delayed]
  • skeledrew 52 minutes ago
    This is how fame happens.
  • xmcp123 26 minutes ago
    Never thought there would be a silver lining on this issue. Fuck yeah.
  • sippingabonedry 48 minutes ago
    Wonderful.

    Anyone else bother to notice iOS still trusts 2 of the forged certs on the test site? I'd like to politely know what the fuck is going on because this is far from being "fixed".

    [-]
    • xuki 41 minutes ago
      Which iOS version? 27.0.1 here and they're all revoked for me.
      [-]
  • DrammBA 1 hour ago
    I love how someone's security disaster becomes someone else's feature.
    [-]
    • Bratmon 1 minute ago
      As the percentage of technology controlled by people actively using it to do evil increases, so does the net value to society of a trivially-expliotable zero-day.
    • xp84 1 hour ago
      I agree. We may as well make some lemonade out of these lemons. IMHO the ability of companies to 'securely' close off hardware and software from their users is a sad casualty of the success of cryptography, and not a feature.
      [-]
      • r3trohack3r 32 minutes ago
        Most things have tradeoffs

        At some point you’re forced to stack rank two or more of your values in a case where they’re mutually exclusive

    • tonymet 57 minutes ago
      I seriously laughed at the flag. public wifi is going to be lit.