Hacker News Reader

Comment by blackbeard | Hacker News Reader

The problem is that it's TLS encrypted traffic going from a black box component to a remote black box service so it's pretty hard to determine what is going over the channel. Without extensive and complex reverse engineering, you can only infer what is going over it and draw some hypotheses that need to be tested. I think that the article is spot on with respect to that.

And of course there is no word from the horse's mouth (Microsoft) at all on ANYTHING related to this. Silence is always worrying.

View on HN

>The problem is that it's TLS encrypted traffic

Unless you can just install a local certificate and proxy it.

Naturally, if they were following "security best practices", they will have pinned the certificates and made no option of overriding them with your own.

It's all "for your security", of course.

Exactly, it takes less than 5 minutes to figure out how to do this with Fiddler or Wireshark...

Taking into account it is Windows, even if it the traffic is "encrypted", I suppose the part of the OS that encrypts it is not obfuscated in any way, so it should be easy to know what it really is doing.

You're right hence the extensive reverse engineering. I think you can expose call graphs and assembly with SoftICE or some product like that and infer which windows API calls are used so that's a starting point. However some of the things that talk are going to be heavily optimised binaries, code signed and difficult to poke inside.

I'm not sure of that, they could even be C# binaries, which are usually easy to disassemble and follow.

Possible. I suspect anything interesting will be C++ however, possibly by design.

Generally speaking you don't need to go to such lengths to intercept client/server communication from your own device. You can even have your wireless devices use your local WiFi, computer and Fiddler (which I think is roughly equivalent to Charles on Linux/iOS) as a proxy to intercept SSL and decrypt communication.

You don't need to bust open the codebase itself to figure out what comms are occurring. You can stage your own MITM attack against yourself with a couple of home made SSL certificates and a router you have the ability to install your own software on.

That's true but then you still have to understand the data that is sent rather than where it is collected from. The of latter is much easier than the former from experience (I've had to reverse engineer a couple of protocols in my time)

Since when does TLS warrant scare quotes around the word "encrypted"?

Why whenever anyone quote anything someone replies criticising them for using "scare quotes?" People commonly use quotations (in English) to emphasise, or to distinguish. It is like a poor man's italics.

Look at the context to decide if someone is using it to imply something is bad/evil/scary, in this case you cannot draw that conclusion. The OP is clearly just using it instead of italics.

Reply on news.ycombinator.com