In this video, we will learn an important technique in dynamic malware analysis called SSL decryption
or SSL interception.
Suppose that we have malicious mobile application running on your smartphone that is connecting over
an encrypted tunnel to a command and control server over the cloud.
Now, one of the things that we need to do is to jump into that tunnel and see if there is sort of malicious
activity taking place.
So how to do that?
Everything is encrypted.
Now, one of the things that we need to do is to install a proxy server in the middle here and drought
our traffic from the mobile phone through this proxy server on that proxy server.
We will install a fake certificate.
So the public certificate, the public and the private key will be exchanged between the mobile phone
and the proxy server.
And now we have the keys so we can decrypt the traffic.
Now the rest of the connection will remain the same.
The proxy server will continue or will forward that traffic to the cloud and controls, or C and C,
a server over the cloud.
So from the proxy server to the cloud, it is still encrypted.
But between our smartphone and the proxy server, it is decrypted and we can see everything that is
taking place there.
Let's go to the demo directly for that purpose.
I'll be using my mobile phone and you have to install two applications.
Actually, if you're trying to do that on a malicious up, make sure you're doing that on a lab and
not on a real phone.
But now I have a safe application.
That's how I'll be doing that on my phone.
So the first thing that I have here is my mobile application.
This is actually a legitimate mobile application I developed for one of my clients.
And it's just a CRM, right.
So you need to know if that application is connecting to a malicious server or performing some activities
in question.
To do that, you need to sniff the traffic.
And as we said, install this proxy server for this purpose.
You need to install an application that will do this for you automatically.
It's called SSL.
Back at capture.
So that application is very simple.
Just open it and you choose the application in which you want to sniff.
So that's the name of the application that I have.
Just click that and it will start sniffing.
Now, when I go use my application, it will record all the activities that are taking place within
this application.
Now, I'll go again to the packet capture and stop it.
Okay.
As you can see here, the date, the time and the number of captures, it is three.
You go down, you drill down and you'll see all the captures which are DCP captures.
You can open one of those and you'll see the HDD.
The request is in blue and the response is in red.
So one of the things to look for is the host.
This is the IP where the application is communicating to you can actually take this IP.
Here you can go to this Web site here.
It's abuse, a PDB.
You can paste that IP or any other IP you suspect, and it will give you some information about it.
If it's blacklisted, it will give you that this IP has been blacklisted and this will give you enough
information on the activities that are taking place within this up.
The capture has many information.
You can take the files from here and you can import them to Wireshark.
You can do further analysis if you want to know more about that.
You can subscribe for my course, Masser Wireshark.
Three in five days and where you will be equipped with enough knowledge to troubleshoot not only the
traffic from mobile applications, but traffic from corporate network and personal network.
Investigate further to spot any out of ordinary behavior or malicious behavior.