Third party IOT Device, traffic through AWS. No local access. Proper way to sniff traffic?

Question

I have a climate monitor/controller that is closed source, has an app for android and ios. all traffic goes through AWS. No open port on device, no local webpage, no local access from app.. Very limited. Only can access via mobile-app using a login/password method. So no IP settings, none of the normal stuff.

Ive looked over the android app source code and to my best of knowledge everything is handled via JSON request.

To my understanding, the normal approach would be to take the device, plug it into the ethernet on my laptop, and use wireshark to capture whatever I can.

However every time ive done this in the past, it was just to view traffic of software on my computer.

So my main questions are.. am i taking the right approach? because of the AWS use, will I find anything useful?

There are endless tutorials that are never updated out there, so if anyone can suggest or recommend anything to me that would aid, I would appreciate it. I can post more detailed device information if required. I will update as I make progress. Thank you.

Answer 1

If the device has been designed properly then even trying to sniff the traffic should not give you anything useful as all the traffic should be encrypted as it travels between the cloud/device.

You've not actually said what the specific device is so we don't known what network connectivity it has, but I'm going to assume it has both Ethernet and WiFi.

The trick is find a place where the network traffic from the device in question actually flows through a point where it can be captured. To do this with your laptop you will probably need to set it up to forward traffic, depending on your OS this can be tricky so I often find it easier to set up a specific other device. I have a Raspberry Pi that I use for this sort of thing. I have it set up as a WiFi access point (using hostapd) this is then bridged to the on board Ethernet which is connected to my normal router.

The WiFi has a different network name to my normal network so I can easily tell it apart. As it is bridged it allows anything connected to that network appears to be wired to my router, this means that it will pick up an IP address, DNS and default route via the usual DHCP. I can then run tcpdump on the Pi to capture all traffic that passes through it. As the test device is the only thing connected to the WiFi it makes filtering out other devices easy. If the test device also/only has Ethernet then I add a USB Ethernet adapter to the Pi and bridge it the same way.

tcpdump outputs pcap files which can then be loaded into wireshark to make interpreting them easier.