Android sniffing using tcpdump

https://dornea.nu/blog/2014/01/24h-android-sniffing-using-tcpdump

by syngres • 12 years ago

75 18 12 years ago

yread• 12 years ago

Great analysis. Interesting 10 times as many requests against 443 than 80. I wouldn't expect that. (of course it doesn't mean it's all HTTPS but still)

slashdotaccount• 12 years ago

Unfortunately the author didn't use mitmproxy (or sslstrip).

eli• 12 years ago

One would hope sslstrip would not work against an app!

barbs• 12 years ago

I'd not heard of the Debian on Android kit [1] before. Sounds interesting! I had heard of using tcpdump to monitor traffic on Android though, and have used this in the past to help debug some network problems we were having with our app. We used a natively compiled version of tcpdump [2]. We still needed to root our phones though.

[1] http://sven-ola.dyndns.org/repo/debian-kit-en.html

[2] http://gadgetcat.wordpress.com/2011/09/11/tcpdump-on-android...

gcp• 12 years ago

tcpdump is pretty easy to crosscompile to Android with a standalone toolchain.

SAFAD• 12 years ago

Interesting results, I am quite shocked that (from a rough general look) all the applications only sent your location, android version, language and user-agent, I was expecting more! Good Job sir :)

joosters• 12 years ago

I don't think you can be sure of that, anything could have been sent over the SSL connections.

irgeek• 12 years ago

Something isn't right here. 80MB of pcap data with 138k packets captured, but over 5 million connections to googleapis.com. That's 36 connections per packet. Also, if you add up the number of packets in the destination port table and divide that into 80MB, it works out to 4 bytes per packet. Which is a bit surprising considering IPv4 has a 20 byte header on every packet.

habales• 12 years ago

Exactly the same what i thought. This would lead to 216 constant packets per second over the 24h

buro93• 12 years ago

It would be great to turn this into an app that tells you what is sending requests to whom.

And then turn that into a game, see who can get the lowest amount of data sent.

Paul_S2• 12 years ago

There are a lot of programs that already let you do that - look for a firewall and a network logger, there are plenty to choose from.

I would be in the running for the main prize then as I use a firewall with a whitelist policy. Everything is blocked (including the system) except the very few applications that I want to communicate. I would still lose to all the people who just disable the data connection.

buro93• 12 years ago

I meant for a non-technical audience.

A game in which participation is to monitor your own data, and to actively play the game you increase your privacy.

A game that educates people as to what your apps are doing and what your phone is doing.

A game that to win (for some local definition of win) means to take control of your privacy.

People like yourself, myself, and most of the HN audience will know how to run firewalls, VPNs, hosts files, rooted phones, disable data, etc. But the layman does not, or is unlikely to do those things as they're scary.

They care, but they don't have a concept on how bad it is and what they can do to improve their lot.

devopstom• 12 years ago

It's way more fun if you put a SSL intercept in place too. I found mitmproxy was probably the easiest to configure, for android.

You can turn up some seriously interesting (scary) things.

_sabe_• 12 years ago

This i found interesting: http://intelcrawler.com/

"Hacktivism, Illicit Drug trade, Cyber Attacks, Human Trafficking, Money Laundering, and other areas - could have a set of predictive probabilities by analyzing huge volumes of data in virtual space and narrowing the common denominator IPs and other cyber prints."

Android sniffing using tcpdump

Related Stories