PPhying中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

Breaking HTTPS in the IoT: Practical Attacks For Reverse Engineers

bishopfox.com | blog | #hardware-security | #reverse-engineering | #iot | #tls | #https | #mitm
📄 Raw .md⬇️ Download .md🔗 Original ↗

Summary

Nathan Elendt shares three man-in-the-middle techniques for breaking HTTPS on production-grade IoT devices, starting with the default TLS hijacking attack that usually just works.
Published
Collected

Related coverage

blog · blog.trailofbits.com
Let’s Encrypt the Internet
Trail of Bits announces support for Let's Encrypt, the open, automated, and free certificate authority, arguing removing cost and renewal friction is key to making HTTPS the default across the web.
blog · hackerone.com
Understanding HTTP and the Critical Shift to HTTPS
A foundational explainer on how HTTP works over IP and TCP, why plaintext transmission endangers privacy and integrity, and why HTTPS encryption became essential for the web.
blog · hackerone.com
Implementing and Auditing HTTPS in Django: Best Practices
A practical guide to enforcing HTTPS in Django, covering security middleware settings for SSL redirects, HSTS with subdomains and preload, and other practices that harden TLS deployment.
blog · hackerone.com
Certificate Pinning: Enhancing Client-Side Security
Explains certificate pinning in clients: basic public-key pinning versus more flexible certificate chain pinning, and how each defends against MITM attacks and compromised certificate authorities.
vulnerability · blog.trailofbits.com
The issue with ATS in Apple’s macOS and iOS
Trail of Bits discloses CVE-2023-38596: Apple's ATS fails to enforce encryption for IP-address and .local connections, exposing iOS and macOS apps to MitM attacks and data exposure.
tool · github.com
gpu-unlock-ada: Linux Kernel Module Unlocking Tensor Core Limits on RTX 40-Series GPUs
Demonstrates how reverse-engineering GPU firmware handoff sequences and hardware registers can bypass artificial consumer hardware compute limits without flashing custom VBIOS, significantly accelerating local AI workloads.
Back