Catch Me If You Can: Hooking your way into encrypted IoT traffic

Abstract:

I wanted to hack a buttplug. And no, that is not the name of the next big pop hit. But really, what happens when you try to hack a buttplug over the internet and its app won’t let you see what it’s saying? This inquisition started with a simple curiosity about adult IoT devices and quickly ran into a ‘wall’: two Chinese companion apps for adult toys that encrypt all their API traffic on top of TLS, making traditional fuzzing and parameter tampering impossible.

‘Come’ with me as we walk through the journey of breaking those protections layer by layer using Frida and Burp Suite, while bypassing SSL certificate pinning, and hooking native OpenSSL functions and pulling AES keys directly out of memory. Along the way, we built CrypticBurp, a Burp extension that decrypts, lets you edit, and re-encrypts app-layer traffic on the fly, making these apps fuzz-able! The talk covers two apps, two different approaches (dynamic instrumentation and static analysis), and makes the case that app-layer encryption on consumer IoT devices could just be security theater hiding hardcoded keys and real vulnerabilities underneath.

Tooling and techniques aside, this talk highlights how methodical reverse engineering can tear down defenses that look solid on the outside but crumble once you start ‘poking’ at them.