mitmproxy adds --emudhra option

 (github.com)

70 points | by ahlCVA 58 minutes ago

7 comments

  • shrubble 28 minutes ago
    If I’m understanding correctly, you could sniff the communication between your Smart TV and the manufacturer using this method?
    [-]
    • the_snooze 9 minutes ago
      As long as the smart TV still trusts eMudhra, then yeah. You'll want to super careful and prevent the TV from pulling updates that could revoke that trust.
    • kevin_nisbet 20 minutes ago
      Possibly. But some manufacturers may not have the full set of roots, use a private authority, or do certificate pinning.
    • quotemstr 21 minutes ago
      If the TV isn't older than a few years, if it's not checking CRLs, and if it hasn't yet patched itself.
  • seniorsassycat 22 minutes ago
    How much of a boon is this for jailbreaking, reverse engineering, and mitm really?
  • wildmXranat 12 minutes ago
    Someone should've coined this disaster as "QuattroFail" to give it a little panache and international mystery
    [-]
    • gnabgib 5 minutes ago
      "4" was only some of the keys (they were all <256).. ByteFail seems more accurate
  • tecleandor 39 minutes ago
    This is gonna be great to sniff apps in a couple older Android phones I have around. Hope they're not pinning certificates.
  • skeledrew 24 minutes ago
    This is how fame happens.
  • sippingabonedry 21 minutes ago
    Wonderful.

    Anyone else bother to notice iOS still trusts 2 of the forged certs on the test site? I'd like to politely know what the fuck is going on because this is far from being "fixed".

    [-]
    • xuki 14 minutes ago
      Which iOS version? 27.0.1 here and they're all revoked for me.
      [-]
      • snailmailman 10 minutes ago
        FWIW i havent updated my ios, I'm on 26.6.2, and they all got revoked for me. The revocation shouldn't require an iOS update.
      • sippingabonedry 6 minutes ago
        26.7.1 still trusts 2 out of the 12 compromised chains. All browsers impacted.
  • DrammBA 37 minutes ago
    I love how someone's security disaster becomes someone else's feature.
    [-]
    • xp84 33 minutes ago
      I agree. We may as well make some lemonade out of these lemons. IMHO the ability of companies to 'securely' close off hardware and software from their users is a sad casualty of the success of cryptography, and not a feature.
      [-]
      • r3trohack3r 5 minutes ago
        Most things have tradeoffs

        At some point you’re forced to stack rank two or more of your values in a case where they’re mutually exclusive

    • tonymet 30 minutes ago
      I seriously laughed at the flag. public wifi is going to be lit.