A hands-on walkthrough of intercepting and redirecting traffic from a Wi-Fi radon sensor to a local server instead of the manufacturer's cloud. By capturing traffic with tcpdump/Wireshark, the author identifies DNS queries and TLS connections the device makes. Exploiting the device's failure to validate TLS certificates, a self-signed cert and a custom DNS override (via Blocky) redirect the sensor's PUT requests to a local Python web server, exposing the raw sensor data. The post also highlights two security lessons: TLS without certificate validation is insecure, and unencrypted DNS traffic leaks browsing/device behavior to network administrators and ISPs.
Table of contents
Who is the sensor talking to and how?What is DNS?What is TLS?Replacing Their Servers With Our OwnDoing Something With the DataWrapping Up27 Impressions