diff --git a/Document0-Initial_Information_Gathering.md b/Document0-Initial_Information_Gathering.md index b07560a..c643385 100644 --- a/Document0-Initial_Information_Gathering.md +++ b/Document0-Initial_Information_Gathering.md @@ -120,24 +120,79 @@ Here you can see: ## 1.6 Collect "Fresh" Firmware Dump -As the lock has been tampered with before, the FW dump is not entirely "fresh." +The device has been tampered with before, therefore there is no fresh dump available. + +## 1.7 && 2.3 Initial setup + +The initial setup is done using the Shelly App. The capture can be found [here](captures/init.pcapng). + +Unsure which IP address is most relevant, here are all Shelly-like or LOQED-like addresses: +- `34.62.47.252`: changelog-backend.shelly.cloud0 +- `34.95.90.149`: control.shelly.cloud +- `104.155.32.247`: shelly-120-eu.shelly.cloud +- `34.155.200.196`: integrations.loqed.com +- `35.205.173.252`: app-ratings.shelly.cloud, paypal.shelly.cloud, shelly-infra1-eu.shelly.cloud +- `34.79.5.199`: shelly-101-eu.shelly.cloud +- `35.241.201.25`: repo.shelly.cloud + +For the PreTester analysis, I chose control.shelly.cloud, as I suspect the lock to communicate to a cloud via the bridge. +As the bridge has a built in ESP32 supporting WiFi, I suspect the communication looks as follows: + +PlantUML sequence diagram of suspected communication flow + +The [PreTester report](pretester_reports/init_report.md) didn't find anything unusual. +It reported no critical or high findings. + +### Old Initial Setup Capture + +You can also find an older initial setup capture made by Manu [here](captures/old_init.pcapng). +I tested this in the PreTester as well using integrations.loqed.com, as this seemed to be the most present IP in the capture. + +The [report](pretester_reports/old_init_report.md) can be found here. +Once again, it reported no critical or high findings. + +> The old init capture supposedly was the first real fresh setup. As mentioned, the lock has been tempered with before. + +### URLs and Endpoints + +I used the PreTester to probe all URLs and endpoints, here are some (interesting) findings: + +|Endpoint|Ports|TLS|Cipher| +|:-|:-|:-|:-| +|app-ratings.shelly.cloud|22, 80, 443, 8000|v1.2|ECDHE-RSA-AES256-GCM-SHA384| +|changelog-backend.shelly.cloud|22, 80, 443|v1.2|ECDHE-ECDSA-AES256-GCM-SHA384| +|control.shelly.cloud|22, 80|v1.3|TLS_AES_256_GCM_SHA384| +|integrations.loqed.com|80, 443, 8080|v1.3|TLS_AES_128_GCM_SHA256| +|paypal.shelly.cloud|22, 80, 443, 8000|v1.3|ECDHE-RSA-AES256-GCM-SHA384| +|repo.shelly.cloud|22, 80, 443|v1.3|TLS_AES_256_GCM_SHA384| +|shelly-101-eu.shelly.cloud|22, 80, 443, **31234**|v1.3|TLS_AES_256_GCM_SHA384| +|shelly-120-eu.shelly.cloud|22, 80, 443, **6113**|v1.3|TLS_AES_256_GCM_SHA384| +|shelly-infra1-eu.shelly.cloud|22, 80, 443, 8000, **9443**|v1.2|ECDHE-RSA-AES256-GCM-SHA384| +|api.production.loqed.com|80, 443, 8080|v1.3|TLS_AES_128_GCM_SHA256| +|mqtt.production.loqed.com|80, 443, 8080, **8883**|v1.3|TLS_AES_128_GCM_SHA256| + +> Includes the old init. + +## 1.8 Collect Firmware Dump of Firmware after initial Setup ### Bridge ### Outer Module -## 1.7 && 2.3 Initial setup - - -## 1.8 Collect Firmware Dump of Firmware after initial Setup - - ## 1.9 && 2.4 Firmware Update ## 1.10 Collect Updated Firmware Dump +### Bridge + +### Outer Module + ## 1.11 Collect Firmware Dump after Factory Reset +### Bridge + +### Outer Module + ## 1.12 (Optional for now) Instantiate Device Model ## 1.13 Collect App APKs diff --git a/captures/init.pcapng b/captures/init.pcapng new file mode 100644 index 0000000..3417be0 Binary files /dev/null and b/captures/init.pcapng differ diff --git a/captures/old_init.pcapng b/captures/old_init.pcapng new file mode 100644 index 0000000..0d3e400 Binary files /dev/null and b/captures/old_init.pcapng differ diff --git a/img/sequence_diagram.png b/img/sequence_diagram.png new file mode 100644 index 0000000..72a55a6 Binary files /dev/null and b/img/sequence_diagram.png differ diff --git a/pretester_reports/init_report.md b/pretester_reports/init_report.md new file mode 100644 index 0000000..bca002e --- /dev/null +++ b/pretester_reports/init_report.md @@ -0,0 +1,305 @@ +# IoT PreTester 4.6 — Network Capture Security Analysis + +- **Capture:** `/app/files/uploads/init-925dbe660d8b.pcapng` +- **Packets:** 3326 · **Duration:** 104.486 s · **Findings:** 7 +- **Device under test:** `34.95.90.149` (MAC 52:54:00:3a:bf:97) · device-related findings: 1, other hosts: 6 + +## Summary + +| Severity | Count | +| ----------- | ------ | +| CRITICAL | 0 | +| HIGH | 0 | +| MEDIUM | 4 | +| LOW | 2 | +| INFO | 1 | + +## Findings + +### 1. Clear-text protocol: HTTP on 151.101.65.91:80 + +- **Severity:** MEDIUM · **Confidence:** high · **Category:** insecure_protocol · **Detector:** InsecureProtocolDetector +- **📍 Sources:** + - Packet #716 · Stream 15 · 10.12.2.14 → 151.101.65.91 · http:80 · Capture init-925dbe660d8b.pcapng + - Packet #744 · Stream 15 · 10.12.2.14 → 151.101.65.91 · http:80 · Capture init-925dbe660d8b.pcapng + - Packet #759 · Stream 15 · 10.12.2.14 → 151.101.65.91 · http:80 · Capture init-925dbe660d8b.pcapng + - Packet #762 · Stream 15 · 10.12.2.14 → 151.101.65.91 · http:80 · Capture init-925dbe660d8b.pcapng +- **Risk:** HTTP content is unencrypted and can be read or modified on the path. +- **Affected:** Source 10.12.2.14, Destination 151.101.65.91, http:80 +- **Additional evidence:** Packets: 716, 744, 759, 762 | Streams: 15 | Time: 2026-10-21 07:10:28 UTC – 2026-10-21 07:10:28 UTC | port=80, packets=10, payload_bytes=672, clients=['10.12.2.14'], client_count=1, external_server=True +- **Recommendation:** Require HTTPS for all device and cloud communication. +- **Finding ID:** `3b872ab0d3a1a494` + +### 2. Clear-text protocol: HTTP on 192.178.194.102:80 + +- **Severity:** MEDIUM · **Confidence:** high · **Category:** insecure_protocol · **Detector:** InsecureProtocolDetector +- **📍 Sources:** + - Packet #1307 · Stream 30 · 10.12.2.14 → 192.178.194.102 · http:80 · Capture init-925dbe660d8b.pcapng + - Packet #1308 · Stream 30 · 10.12.2.14 → 192.178.194.102 · http:80 · Capture init-925dbe660d8b.pcapng + - Packet #1309 · Stream 30 · 10.12.2.14 → 192.178.194.102 · http:80 · Capture init-925dbe660d8b.pcapng + - Packet #1310 · Stream 30 · 10.12.2.14 → 192.178.194.102 · http:80 · Capture init-925dbe660d8b.pcapng +- **Risk:** HTTP content is unencrypted and can be read or modified on the path. +- **Affected:** Source 10.12.2.14, Destination 192.178.194.102, http:80 +- **Additional evidence:** Packets: 1307, 1308, 1309, 1310 | Streams: 30 | Time: 2026-10-21 07:10:36 UTC – 2026-10-21 07:10:36 UTC | port=80, packets=7, payload_bytes=312, clients=['10.12.2.14'], client_count=1, external_server=True +- **Recommendation:** Require HTTPS for all device and cloud communication. +- **Finding ID:** `401b185216f10382` + +### 3. Clear-text protocol: HTTP on 10.12.2.17:80 + +- **Severity:** MEDIUM · **Confidence:** high · **Category:** insecure_protocol · **Detector:** InsecureProtocolDetector +- **📍 Sources:** + - Packet #1632 · Stream 39 · 10.12.2.14 → 10.12.2.17 · http:80 · Capture init-925dbe660d8b.pcapng + - Packet #1659 · Stream 39 · 10.12.2.14 → 10.12.2.17 · http:80 · Capture init-925dbe660d8b.pcapng + - Packet #1711 · Stream 39 · 10.12.2.14 → 10.12.2.17 · http:80 · Capture init-925dbe660d8b.pcapng + - Packet #1712 · Stream 39 · 10.12.2.14 → 10.12.2.17 · http:80 · Capture init-925dbe660d8b.pcapng +- **Risk:** HTTP content is unencrypted and can be read or modified on the path. +- **Affected:** Source 10.12.2.14, Destination 10.12.2.17, http:80 +- **Additional evidence:** Packets: 1632, 1659, 1711, 1712 | Streams: 39 | Time: 2026-10-21 07:10:38 UTC – 2026-10-21 07:10:39 UTC | port=80, packets=13, payload_bytes=221, clients=['10.12.2.14'], client_count=1, external_server=False +- **Recommendation:** Require HTTPS for all device and cloud communication. +- **Finding ID:** `a80245540240803f` + +### 4. Overlong DNS label suggests tunneling + +- **Severity:** MEDIUM · **Confidence:** low · **Category:** dns_anomaly · **Detector:** DnsAnomalyDetector +- **🔎 Observed artifact:** `DNS query: d7ae3d206ce5366b0f0105dc74e8b013274baf9c15fd9588c12a576fa3ac95c.us-east-1.prod.service.minerva.devices.a2z.com` +- **📍 Sources:** + - Packet #307 · 2026-10-21 07:10:14 UTC · 10.12.0.200 → 8.8.8.8 · dns:53 · Capture init-925dbe660d8b.pcapng +- **Risk:** A DNS label of 63 characters was observed under a2z.com. Overlong labels are used to encode data in DNS tunnels. +- **Affected:** Source 10.12.0.200, Destination 8.8.8.8, dns:53, a2z.com +- **Additional evidence:** Packets: 307 | Time: 2026-10-21 07:10:14 UTC – 2026-10-21 07:10:14 UTC | registered_domain=a2z.com, query_name=d7ae3d206ce5366b0f0105dc74e8b013274baf9c15fd9588c12a576fa3ac95c.us-east-1.prod.service.minerva.devices.a2z.com, label_length=63, device_related=False +- **Recommendation:** Review the destination domain and enable tunneling detection. +- **Finding ID:** `2bde55c6733c1b91` + +### 5. DNS sent directly to an external resolver (8.8.8.8) + +- **Severity:** LOW · **Confidence:** high · **Category:** dns_anomaly · **Detector:** DnsAnomalyDetector +- **📍 Sources:** + - Packet #307 · 2026-10-21 07:10:14 UTC · 10.12.0.200 → 8.8.8.8 · dns:53 · Capture init-925dbe660d8b.pcapng +- **Risk:** The host resolves names through a hard-coded external resolver instead of the one assigned by the network. Local DNS filtering and monitoring are bypassed and the queries are visible to a third party. +- **Affected:** Source 10.12.0.200, Destination 8.8.8.8, dns:53 +- **Additional evidence:** Packets: 307 | Time: 2026-10-21 07:10:14 UTC – 2026-10-21 07:10:14 UTC | queries=28, device_related=False +- **Recommendation:** Use the DHCP-assigned resolver, or DNS over TLS/HTTPS if privacy is required. +- **Finding ID:** `b90cea9473b87e9a` + +### 6. Randomly-structured DNS name observed + +- **Severity:** LOW · **Confidence:** low · **Category:** dns_anomaly · **Detector:** DnsAnomalyDetector +- **🔎 Observed artifact:** `Domain: mozilla.net` +- **📍 Sources:** + - Packet #673 · 10.12.0.200 → 8.8.8.8 · dns:53 · Capture init-925dbe660d8b.pcapng + - Packet #817 · 10.12.0.200 → 8.8.8.8 · dns:53 · Capture init-925dbe660d8b.pcapng + - Packet #818 · 10.12.0.200 → 8.8.8.8 · dns:53 · Capture init-925dbe660d8b.pcapng +- **Risk:** A DNS name with a random-looking label was queried under mozilla.net. In isolation this is a weak indicator; it becomes significant only alongside many such names or other anomalies. +- **Affected:** Source 10.12.0.200, Destination 8.8.8.8, dns:53, mozilla.net +- **Additional evidence:** Packets: 673, 817, 818 | Time: 2026-10-21 07:10:28 UTC – 2026-10-21 07:10:28 UTC | registered_domain=mozilla.net, distinct_random_subdomains=1, examples=['content-signature-2.cdn'], device_related=False +- **Recommendation:** Confirm the domain is a legitimate service; otherwise check it against threat intelligence. +- **Finding ID:** `bd7db6daa73bc8dc` + +### 7. Device offers a network service on port 443 + +- **Severity:** INFO · **Confidence:** high · **Category:** insecure_protocol · **Detector:** InsecureProtocolDetector +- **📍 Sources:** + - ? → 34.95.90.149 · tls:443 · Capture init-925dbe660d8b.pcapng · aggregated evidence; no single packet is available +- **Risk:** The device accepted connections on this port. Every listening service is attack surface and should be known and justified. +- **Affected:** Device 34.95.90.149, Destination 34.95.90.149, tls:443 · **involves device under test** +- **Additional evidence:** Time: — – — | port=443, protocols=['tls'], device_related=True +- **Recommendation:** Confirm the service is required, authenticated and encrypted; disable it otherwise. +- **Finding ID:** `016728bd857643ed` + + +## Observation Inventory + +- Capture: 3326 packets, 104.486 s, 4 internal and 23 external hosts, 82 flows, VLANs 1, 200 · extractor tshark 4.4.19 + +### Device under test +- `34.95.90.149` · MAC 52:54:00:3a:bf:97 · names — +- 138 packets · sent 83.1 kB · received 6.8 kB · first seen 2026-10-21 07:10:33 UTC · last seen 2026-10-21 07:10:39 UTC +- Services offered: 443 · ports contacted: — +- Protocols: tls · TLS sessions: 0 · clear-text flows: 0 +- Peers (1): + - `10.12.2.14` (10-12-2-14.local) · internal · ports 46126, 46136, 55238, 55248 · tls · to peer 83.1 kB / from peer 6.8 kB + +### Internal hosts (4) +- `10.12.2.14` · MAC 6e:bd:64:d7:9a:69 · 1628 packets · offers — · 22 external endpoints +- `10.12.2.17` · MAC 8c:4b:14:6a:1a:cc · 110 packets · offers 80 · 1 external endpoints +- `10.12.0.200` · MAC c8:7f:54:de:c0:38 · 59 packets · offers — · 1 external endpoints +- `10.12.0.250` · MAC 52:54:00:3a:bf:97 · 3 packets · offers 53 · 0 external endpoints + +### External endpoints (23) +- `151.101.1.91` (firefox-portal-detection.com, merino.services.mozilla.com) · ports 443 · tls · encrypted · out 4.2 kB / in 100.7 kB +- `34.95.90.149` (control.shelly.cloud) · ports 443 · tls · encrypted · out 6.8 kB / in 83.1 kB +- `104.155.32.247` (shelly-120-eu.shelly.cloud) · ports 443, 6113 · tls · encrypted · out 32.1 kB / in 28.3 kB +- `34.155.200.196` (integrations.loqed.com) · ports 443, 8883 · tls · encrypted · out 8.7 kB / in 32.6 kB +- `34.54.185.247` (incoming.telemetry.mozilla.org) · ports 443 · tls · encrypted · out 25.4 kB / in 15.3 kB +- `192.178.194.139` (android.clients.google.com, play-fe.googleapis.com) · ports 443 · quic, tls · encrypted · out 18.3 kB / in 15.0 kB +- `3.91.171.220` (kinesis.us-east-1.amazonaws.com) · ports 443 · tls · encrypted · out 13.7 kB / in 15.6 kB +- `35.205.173.252` (app-ratings.shelly.cloud, paypal.shelly.cloud, shelly-infra1-eu.shelly.cloud) · ports 443, 9443 · tls · encrypted · out 9.6 kB / in 18.3 kB +- `34.62.47.252` (changelog-backend.shelly.cloud) · ports 443 · tls · encrypted · out 5.8 kB / in 21.7 kB +- `34.79.5.199` (shelly-101-eu.shelly.cloud) · ports 31234 · tls · encrypted · out 7.9 kB / in 19.4 kB +- `51.124.96.69` (app-api.cmap.abus.com) · ports 443 · tls · encrypted · out 11.5 kB / in 11.9 kB +- `34.117.64.196` (assets.mozilla.net) · ports 443 · tls · encrypted · out 5.6 kB / in 16.2 kB +- `100.50.70.74` (d7ae3d206ce5366b0f0105dc74e8b013274baf9c15fd9588c12a576fa3ac95c.us-east-1.prod.service.minerva.devices.a2z.com) · ports 443 · tls · encrypted · out 4.4 kB / in 11.0 kB +- `34.149.226.178` (content-signature-2.cdn.mozilla.net) · ports 443 · tls · encrypted · out 2.9 kB / in 11.3 kB +- `35.241.201.25` (repo.shelly.cloud) · ports 443 · tls · encrypted · out 2.6 kB / in 9.7 kB +- `192.178.194.95` (fonts.googleapis.com) · ports 443 · quic, tls · encrypted · out 4.4 kB / in 7.2 kB +- `142.251.27.94` (fonts.gstatic.com) · ports 443 · quic, tls · encrypted · out 4.3 kB / in 7.0 kB +- `142.251.150.120` (connectivitycheck.gstatic.com) · ports 443 · tls · encrypted · out 3.0 kB / in 8.1 kB +- `172.217.119.4` (play.googleapis.com, playstoregatewayadapter-pa.googleapis.com, prod-lt-playstoregatewayadapter-pa.googleapis.com, remoteprovisioning.googleapis.com) · ports 443 · tls · encrypted · out 4.1 kB / in 6.1 kB +- `8.8.8.8` · ports 53 · dns · clear-text or unknown · out 2.5 kB / in 5.1 kB +- `151.101.65.91` (firefox-portal-detection.com, merino.services.mozilla.com) · ports 80 · http · clear-text or unknown · out 661 B / in 727 B +- `192.178.194.102` (android.clients.google.com, clients3.google.com, play-fe.googleapis.com) · ports 80 · http · clear-text or unknown · out 543 B / in 345 B +- `51.102.84.134` · ports 443 · undecoded · clear-text or unknown · out 70 B / in 0 B + +### Services observed (29) +- `34.95.90.149:443` https (tcp) ← device · encrypted · 2 flows from 1 clients +- `10.12.0.200:53` dns (udp) · unknown · 1 flows from 1 clients +- `10.12.0.250:53` dns (udp) · unknown · 1 flows from 1 clients +- `10.12.2.17:80` http (tcp) · clear-text · 1 flows from 1 clients +- `100.50.70.74:443` https (tcp) · encrypted · 2 flows from 1 clients +- `104.155.32.247:443` https (tcp) · encrypted · 4 flows from 1 clients +- `104.155.32.247:6113` tls/6113 (tcp) · encrypted · 2 flows from 1 clients +- `142.251.150.120:443` https (tcp) · encrypted · 2 flows from 1 clients +- `142.251.27.94:443` quic (udp) · encrypted · 1 flows from 1 clients +- `151.101.1.91:443` https (tcp) · encrypted · 1 flows from 1 clients +- `151.101.65.91:80` http (tcp) · clear-text · 1 flows from 1 clients +- `172.217.119.4:443` https (tcp) · encrypted · 1 flows from 1 clients +- `192.178.194.102:80` http (tcp) · clear-text · 1 flows from 1 clients +- `192.178.194.139:443` https (tcp) · encrypted · 1 flows from 1 clients +- `192.178.194.139:443` quic (udp) · encrypted · 2 flows from 1 clients +- `192.178.194.95:443` quic (udp) · encrypted · 1 flows from 1 clients +- `3.91.171.220:443` https (tcp) · encrypted · 2 flows from 1 clients +- `34.117.64.196:443` https (tcp) · encrypted · 2 flows from 1 clients +- `34.149.226.178:443` https (tcp) · encrypted · 2 flows from 1 clients +- `34.155.200.196:443` https (tcp) · encrypted · 1 flows from 1 clients +- `34.155.200.196:8883` mqtts (tcp) · encrypted · 1 flows from 1 clients +- `34.54.185.247:443` https (tcp) · encrypted · 2 flows from 1 clients +- `34.62.47.252:443` https (tcp) · encrypted · 4 flows from 1 clients +- `34.79.5.199:31234` tls/31234 (tcp) · encrypted · 2 flows from 1 clients +- `35.205.173.252:443` https (tcp) · encrypted · 2 flows from 1 clients +- `35.205.173.252:9443` tls/9443 (tcp) · encrypted · 1 flows from 1 clients +- `35.241.201.25:443` https (tcp) · encrypted · 1 flows from 1 clients +- `51.124.96.69:443` https (tcp) · encrypted · 1 flows from 1 clients +- `8.8.8.8:53` dns (udp) · unknown · 28 flows from 1 clients + +### Protocols (packets) +- ip 1784, arp 1542, tcp 1414, tls 588, udp 370, mdns 222, quic 89, dns 59, http 6, icmp 1 +- ICMP: unreachable 1 + +### TLS posture (35 handshakes) +- Versions: TLS 1.3 ×23, TLS 1.2 ×12 +- Cipher suites: TLS_AES_128_GCM_SHA256 ×14, TLS_AES_256_GCM_SHA384 ×9, TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 ×2, TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256 ×8, TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256 ×2 +- 10.12.2.14 → `34.95.90.149:443` (control.shelly.cloud) ← device · TLS 1.3 · TLS_AES_128_GCM_SHA256 · client max TLS 1.3 +- 10.12.2.14 → `34.95.90.149:443` (control.shelly.cloud) ← device · TLS 1.3 · TLS_AES_128_GCM_SHA256 · client max TLS 1.3 +- 10.12.2.14 → `100.50.70.74:443` (d7ae3d206ce5366b0f0105dc74e8b013274baf9c15fd9588c12a576fa3ac95c.us-east-1.prod.service.minerva.devices.a2z.com) · TLS 1.3 · TLS_AES_128_GCM_SHA256 · client max TLS 1.3 +- 10.12.2.14 → `100.50.70.74:443` (d7ae3d206ce5366b0f0105dc74e8b013274baf9c15fd9588c12a576fa3ac95c.us-east-1.prod.service.minerva.devices.a2z.com) · TLS 1.3 · TLS_AES_128_GCM_SHA256 · client max TLS 1.3 +- 10.12.2.14 → `104.155.32.247:443` (shelly-120-eu.shelly.cloud) · TLS 1.3 · TLS_AES_128_GCM_SHA256 · client max TLS 1.3 +- 10.12.2.14 → `104.155.32.247:443` (shelly-120-eu.shelly.cloud) · TLS 1.3 · TLS_AES_128_GCM_SHA256 · client max TLS 1.3 +- 10.12.2.14 → `104.155.32.247:443` (shelly-120-eu.shelly.cloud) · TLS 1.3 · TLS_AES_128_GCM_SHA256 · client max TLS 1.3 +- 10.12.2.14 → `104.155.32.247:6113` (shelly-120-eu.shelly.cloud) · TLS 1.3 · TLS_AES_256_GCM_SHA384 · client max TLS 1.3 +- 10.12.2.14 → `142.251.150.120:443` (connectivitycheck.gstatic.com) · TLS 1.3 · TLS_AES_128_GCM_SHA256 · client max TLS 1.3 +- 10.12.2.14 → `142.251.150.120:443` (connectivitycheck.gstatic.com) · TLS 1.3 · TLS_AES_128_GCM_SHA256 · client max TLS 1.3 +- 10.12.2.14 → `142.251.27.94:443` (fonts.gstatic.com) · TLS 1.3 · TLS_AES_128_GCM_SHA256 · client max TLS 1.3 +- 10.12.2.14 → `151.101.1.91:443` (merino.services.mozilla.com) · TLS 1.2 · TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256 · client max TLS 1.2 · cert merino.services.mozilla.com by YR1, expires 2026-12-25 12:57:43 UTC +- 10.12.2.14 → `172.217.119.4:443` (remoteprovisioning.googleapis.com) · TLS 1.3 · TLS_AES_256_GCM_SHA384 · client max TLS 1.3 +- 10.12.2.14 → `192.178.194.139:443` (play-fe.googleapis.com) · TLS 1.3 · TLS_AES_256_GCM_SHA384 · client max TLS 1.3 +- 10.12.2.14 → `192.178.194.139:443` (play-fe.googleapis.com) · TLS 1.3 · TLS_AES_256_GCM_SHA384 · client max TLS 1.3 +- 10.12.2.14 → `192.178.194.139:443` (play-fe.googleapis.com) · TLS 1.3 · TLS_AES_256_GCM_SHA384 · client max TLS 1.3 +- 10.12.2.14 → `192.178.194.95:443` (fonts.googleapis.com) · TLS 1.3 · TLS_AES_256_GCM_SHA384 · client max TLS 1.3 +- 10.12.2.14 → `3.91.171.220:443` (kinesis.us-east-1.amazonaws.com) · TLS 1.3 · TLS_AES_128_GCM_SHA256 · client max TLS 1.3 +- 10.12.2.14 → `3.91.171.220:443` (kinesis.us-east-1.amazonaws.com) · TLS 1.3 · TLS_AES_128_GCM_SHA256 · client max TLS 1.3 +- 10.12.2.14 → `34.117.64.196:443` (assets.mozilla.net) · TLS 1.2 · TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256 · client max TLS 1.2 · cert cdn.website.assets-mozilla-net.prod.webservices.mozgcp.net by YR2, expires 2026-11-21 22:55:06 UTC +- 10.12.2.14 → `34.117.64.196:443` (assets.mozilla.net) · TLS 1.2 · TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256 · client max TLS 1.2 · cert cdn.website.assets-mozilla-net.prod.webservices.mozgcp.net by YR2, expires 2026-11-21 22:55:06 UTC +- 10.12.2.14 → `34.149.226.178:443` (content-signature-2.cdn.mozilla.net) · TLS 1.2 · TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256 · client max TLS 1.2 · cert content-signature-2.cdn.mozilla.net by YR2, expires 2026-12-23 09:28:57 UTC +- 10.12.2.14 → `34.149.226.178:443` (content-signature-2.cdn.mozilla.net) · TLS 1.2 · TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256 · client max TLS 1.2 · cert content-signature-2.cdn.mozilla.net by YR2, expires 2026-12-23 09:28:57 UTC +- 10.12.2.14 → `34.155.200.196:443` (integrations.loqed.com) · TLS 1.3 · TLS_AES_128_GCM_SHA256 · client max TLS 1.3 +- 10.12.2.14 → `34.54.185.247:443` (incoming.telemetry.mozilla.org) · TLS 1.2 · TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256 · client max TLS 1.2 · cert incoming.telemetry.mozilla.org by DigiCert Global G2 TLS RSA SHA256 2020 CA1, expires 2026-11-19 23:59:59 UTC +- 10.12.2.14 → `34.54.185.247:443` (incoming.telemetry.mozilla.org) · TLS 1.2 · TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256 · client max TLS 1.2 +- 10.12.2.14 → `34.62.47.252:443` (changelog-backend.shelly.cloud) · TLS 1.2 · TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256 · client max TLS 1.3 · cert changelog-backend.shelly.cloud by YE1, expires 2026-12-20 09:03:22 UTC +- 10.12.2.14 → `34.62.47.252:443` (changelog-backend.shelly.cloud) · TLS 1.2 · TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256 · client max TLS 1.3 · cert changelog-backend.shelly.cloud by YE1, expires 2026-12-20 09:03:22 UTC +- 10.12.2.14 → `34.79.5.199:31234` (shelly-101-eu.shelly.cloud) · TLS 1.3 · TLS_AES_256_GCM_SHA384 · client max TLS 1.3 +- 10.12.2.14 → `34.79.5.199:31234` (shelly-101-eu.shelly.cloud) · TLS 1.3 · TLS_AES_256_GCM_SHA384 · client max TLS 1.3 + +### DNS (176 queries, 30 responses, 25 names) +- Response codes: NOERROR 29, NXDOMAIN 1 · resolvers: 8.8.8.8 (28), 10.12.0.250 (1), 10.12.0.200 (1) +- `_http._tcp.local` · 60× · PTR · no answer seen +- `_shelly._tcp.local` · 60× · PTR · no answer seen +- `10-12-2-14.local` · 27× · ANY · no answer seen +- `firefox-portal-detection.com` · 3× · A, HTTPS · 151.101.1.91, 151.101.129.91, 151.101.193.91, 151.101.65.91 +- `incoming.telemetry.mozilla.org` · 3× · A, HTTPS · 34.54.185.247 +- `assets.mozilla.net` · 2× · A, HTTPS · 34.117.64.196 +- `fonts.googleapis.com` · 2× · A, HTTPS · 192.178.194.95 +- `merino.services.mozilla.com` · 2× · A, HTTPS · 151.101.1.91, 151.101.129.91, 151.101.193.91, 151.101.65.91 +- `_31234._https.shelly-101-eu.shelly.cloud` · 1× · HTTPS · no answer seen +- `android.clients.google.com` · 1× · A · 142.251.27.102, 142.251.27.139, 172.217.168.142, 192.178.194.102, 192.178.194.138, 192.178.194.139 +- `cloudflare-dns.com` · 1× · HTTPS · no answer seen +- `content-signature-2.cdn.mozilla.net` · 1× · HTTPS · no answer seen +- `d7ae3d206ce5366b0f0105dc74e8b013274baf9c15fd9588c12a576fa3ac95c.us-east-1.prod.service.minerva.devices.a2z.com` · 1× · A · 100.31.167.60, 100.50.70.74, 13.216.221.160, 52.45.179.236 +- `example.org` · 1× · A · 104.20.26.136, 172.66.157.237 +- `fonts.gstatic.com` · 1× · HTTPS · no answer seen +- `i.ytimg.com` · 1× · A · 142.251.145.6, 142.251.147.6, 142.251.148.6, 142.251.149.6, 192.178.40.6, 192.178.41.6 +- `integrations.loqed.com` · 1× · HTTPS · no answer seen +- `kinesis.us-east-1.amazonaws.com` · 1× · A · 3.91.171.220 +- `play-fe.googleapis.com` · 1× · A · 192.178.194.100, 192.178.194.101, 192.178.194.102, 192.178.194.113, 192.178.194.138, 192.178.194.139 +- `play-lh.googleusercontent.com` · 1× · A · 192.178.194.119 +- `play.googleapis.com` · 1× · A · 172.217.113.4, 172.217.114.4, 172.217.115.4, 172.217.116.4, 172.217.118.4, 172.217.119.4 +- `playstoregatewayadapter-pa.googleapis.com` · 1× · A · 172.217.112.4, 172.217.114.4, 172.217.116.4, 172.217.117.4, 172.217.118.4, 172.217.119.4 +- `prod-lt-playstoregatewayadapter-pa.googleapis.com` · 1× · A · 172.217.112.4, 172.217.113.4, 172.217.114.4, 172.217.115.4, 172.217.117.4, 172.217.118.4 +- `remoteprovisioning.googleapis.com` · 1× · A · 172.217.112.4, 172.217.113.4, 172.217.114.4, 172.217.117.4, 172.217.118.4, 172.217.119.4 +- `shelly-101-eu.shelly.cloud` · 1× · A · 34.79.5.199 + +### HTTP (6 requests) +- `10.12.2.14` · 3 requests · · /success.txt?ipv4, /generate_204, /shelly +- `firefox-portal-detection.com` · 1 requests · GET · /success.txt?ipv4 +- `clients3.google.com` · 1 requests · GET · /generate_204 +- `10.12.2.17` · 1 requests · GET · /shelly + +### Clear-text protocols and service events +- http: 3 flows, 1.2 kB · 10.12.2.14 -> 10.12.2.17:80; 10.12.2.14 -> 151.101.65.91:80; 10.12.2.14 -> 192.178.194.102:80 + +### Coverage +- Complete extraction · 82 flows, 40 encrypted, 0 with undecoded payload · 18 clear-text payloads scanned +- 23 TLS 1.3 sessions: server certificates are encrypted and could not be inspected. + +## Cloud URLs and Endpoints (38) + +- `10-12-2-14.local` — Ports: —; TLS: N/A; Cipher: N/A +- `10.12.2.17` — Ports: —; TLS: N/A; Cipher: N/A +- `51.102.84.134` — Ports: 443, 8000; TLS: N/A; Cipher: N/A +- `8.8.8.8` — Ports: 53, 443; TLS: TLSv1.3; Cipher: TLS_AES_256_GCM_SHA384 +- `_31234._https.shelly-101-eu.shelly.cloud` — Ports: —; TLS: N/A; Cipher: N/A +- `_http._tcp.local` — Ports: —; TLS: N/A; Cipher: N/A +- `_shelly._tcp.local` — Ports: —; TLS: N/A; Cipher: N/A +- `android.clients.google.com` — Ports: 80, 443; TLS: TLSv1.3; Cipher: TLS_AES_256_GCM_SHA384 +- `app-api.cmap.abus.com` — Ports: 80, 443; TLS: TLSv1.2; Cipher: ECDHE-RSA-AES256-SHA384 +- `app-ratings.shelly.cloud` — Ports: 22, 80, 443, 8000; TLS: TLSv1.2; Cipher: ECDHE-RSA-AES256-GCM-SHA384 +- `assets.mozilla.net` — Ports: 80, 443; TLS: TLSv1.3; Cipher: TLS_AES_256_GCM_SHA384 +- `changelog-backend.shelly.cloud` — Ports: 22, 80, 443; TLS: TLSv1.2; Cipher: ECDHE-ECDSA-AES256-GCM-SHA384 +- `clients3.google.com` — Ports: 80, 443; TLS: TLSv1.3; Cipher: TLS_AES_256_GCM_SHA384 +- `cloudflare-dns.com` — Ports: 80, 443, 8080; TLS: TLSv1.3; Cipher: TLS_AES_256_GCM_SHA384 +- `connectivitycheck.gstatic.com` — Ports: 80, 443; TLS: TLSv1.3; Cipher: TLS_AES_256_GCM_SHA384 +- `content-signature-2.cdn.mozilla.net` — Ports: 80, 443; TLS: TLSv1.3; Cipher: TLS_AES_256_GCM_SHA384 +- `control.shelly.cloud` — Ports: 80, 443; TLS: TLSv1.3; Cipher: TLS_AES_256_GCM_SHA384 +- `d7ae3d206ce5366b0f0105dc74e8b013274baf9c15fd9588c12a576fa3ac95c.us-east-1.prod.service.minerva.devices.a2z.com` — Ports: 443; TLS: TLSv1.3; Cipher: TLS_AES_128_GCM_SHA256 +- `example.org` — Ports: 80, 443, 8080; TLS: TLSv1.3; Cipher: TLS_AES_256_GCM_SHA384 +- `firefox-portal-detection.com` — Ports: 80, 443; TLS: TLSv1.3; Cipher: TLS_AES_128_GCM_SHA256 +- `fonts.googleapis.com` — Ports: 80, 443; TLS: TLSv1.3; Cipher: TLS_AES_256_GCM_SHA384 +- `fonts.gstatic.com` — Ports: 80, 443; TLS: TLSv1.3; Cipher: TLS_AES_256_GCM_SHA384 +- `i.ytimg.com` — Ports: 80, 443; TLS: TLSv1.3; Cipher: TLS_AES_256_GCM_SHA384 +- `incoming.telemetry.mozilla.org` — Ports: 80, 443; TLS: TLSv1.3; Cipher: TLS_AES_256_GCM_SHA384 +- `integrations.loqed.com` — Ports: 80, 443, 8080; TLS: TLSv1.3; Cipher: TLS_AES_128_GCM_SHA256 +- `kinesis.us-east-1.amazonaws.com` — Ports: 443; TLS: TLSv1.3; Cipher: TLS_AES_128_GCM_SHA256 +- `merino.services.mozilla.com` — Ports: 80, 443; TLS: TLSv1.3; Cipher: TLS_AES_128_GCM_SHA256 +- `paypal.shelly.cloud` — Ports: 22, 80, 443, 8000; TLS: TLSv1.2; Cipher: ECDHE-RSA-AES256-GCM-SHA384 +- `play-fe.googleapis.com` — Ports: 80, 443; TLS: TLSv1.3; Cipher: TLS_AES_256_GCM_SHA384 +- `play-lh.googleusercontent.com` — Ports: 80, 443; TLS: TLSv1.3; Cipher: TLS_AES_256_GCM_SHA384 +- `play.googleapis.com` — Ports: 80, 443; TLS: TLSv1.3; Cipher: TLS_AES_256_GCM_SHA384 +- `playstoregatewayadapter-pa.googleapis.com` — Ports: 80, 443; TLS: TLSv1.3; Cipher: TLS_AES_256_GCM_SHA384 +- `prod-lt-playstoregatewayadapter-pa.googleapis.com` — Ports: 80, 443; TLS: TLSv1.3; Cipher: TLS_AES_256_GCM_SHA384 +- `remoteprovisioning.googleapis.com` — Ports: 80, 443; TLS: TLSv1.3; Cipher: TLS_AES_256_GCM_SHA384 +- `repo.shelly.cloud` — Ports: 22, 80, 443; TLS: TLSv1.3; Cipher: TLS_AES_256_GCM_SHA384 +- `shelly-101-eu.shelly.cloud` — Ports: 22, 80, 443, 31234; TLS: TLSv1.3; Cipher: TLS_AES_256_GCM_SHA384 +- `shelly-120-eu.shelly.cloud` — Ports: 22, 80, 443, 6113; TLS: TLSv1.3; Cipher: TLS_AES_256_GCM_SHA384 +- `shelly-infra1-eu.shelly.cloud` — Ports: 22, 80, 443, 8000, 9443; TLS: TLSv1.2; Cipher: ECDHE-RSA-AES256-GCM-SHA384 + +--- +_Generated by IoT PreTester 4.6 · Detectors: PlaintextCredentialDetector, PasswordHashDetector, TokenSecretDetector, MalwareBeaconingDetector, ExfiltrationDetector, MitmDetector, InsecureProtocolDetector, TlsWeaknessDetector, DnsAnomalyDetector, BruteforceScanFileTransferDetector_ \ No newline at end of file diff --git a/pretester_reports/old_init_report.md b/pretester_reports/old_init_report.md new file mode 100644 index 0000000..d6a1dad --- /dev/null +++ b/pretester_reports/old_init_report.md @@ -0,0 +1,406 @@ +# IoT PreTester 4.6 — Network Capture Security Analysis + +- **Capture:** `/app/files/uploads/old_init-2d7aed437f3d.pcapng` +- **Packets:** 12383 · **Duration:** 331.027 s · **Findings:** 7 +- **Device under test:** `34.155.200.196` (MAC 52:54:00:71:bb:02) · device-related findings: 3, other hosts: 4 + +## Summary + +| Severity | Count | +| ----------- | ------ | +| CRITICAL | 0 | +| HIGH | 0 | +| MEDIUM | 1 | +| LOW | 4 | +| INFO | 2 | + +## Findings + +### 1. Clear-text protocol: HTTP on 142.250.154.94:80 + +- **Severity:** MEDIUM · **Confidence:** high · **Category:** insecure_protocol · **Detector:** InsecureProtocolDetector +- **📍 Sources:** + - Packet #5211 · Stream 134 · 10.12.0.103 → 142.250.154.94 · http:80 · Capture old_init-2d7aed437f3d.pcapng + - Packet #5215 · Stream 134 · 10.12.0.103 → 142.250.154.94 · http:80 · Capture old_init-2d7aed437f3d.pcapng + - Packet #5219 · Stream 134 · 10.12.0.103 → 142.250.154.94 · http:80 · Capture old_init-2d7aed437f3d.pcapng + - Packet #5222 · Stream 134 · 10.12.0.103 → 142.250.154.94 · http:80 · Capture old_init-2d7aed437f3d.pcapng +- **Risk:** HTTP content is unencrypted and can be read or modified on the path. +- **Affected:** Source 10.12.0.103, Destination 142.250.154.94, http:80 +- **Additional evidence:** Packets: 5211, 5215, 5219, 5222 | Streams: 134 | Time: 2026-07-08 08:44:30 UTC – 2026-07-08 08:44:30 UTC | port=80, packets=10, payload_bytes=373, clients=['10.12.0.103'], client_count=1, external_server=True +- **Recommendation:** Require HTTPS for all device and cloud communication. +- **Finding ID:** `d31487f489fcc8f4` + +### 2. Many small outbound connections to one target + +- **Severity:** LOW · **Confidence:** low · **Category:** exfiltration · **Detector:** ExfiltrationDetector +- **📍 Sources:** + - Packet #22 · 10.12.0.103 → 34.155.200.196 · Capture old_init-2d7aed437f3d.pcapng + - Packet #56 · 10.12.0.103 → 34.155.200.196 · Capture old_init-2d7aed437f3d.pcapng + - Packet #92 · 10.12.0.103 → 34.155.200.196 · Capture old_init-2d7aed437f3d.pcapng + - Packet #127 · 10.12.0.103 → 34.155.200.196 · Capture old_init-2d7aed437f3d.pcapng + - Packet #163 · 10.12.0.103 → 34.155.200.196 · Capture old_init-2d7aed437f3d.pcapng + - Packet #200 · 10.12.0.103 → 34.155.200.196 · Capture old_init-2d7aed437f3d.pcapng + - Packet #236 · 10.12.0.103 → 34.155.200.196 · Capture old_init-2d7aed437f3d.pcapng + - Packet #288 · 10.12.0.103 → 34.155.200.196 · Capture old_init-2d7aed437f3d.pcapng + - … and 270 more packets +- **Risk:** Many short outbound connections to one target may indicate segmented uploads or polling. +- **Affected:** Device 34.155.200.196, Source 10.12.0.103, Destination 34.155.200.196 · **involves device under test** +- **Additional evidence:** Packets: 22, 56, 92, 127, 163, 200, 236, 288 | Streams: 3, 4, 5, 6, 7, 8, 9, 13 | Time: — – — | transfer_count=278, target_names=['api.production.loqed.com', 'mqtt.production.loqed.com'], device_related=True +- **Recommendation:** Investigate the connection pattern and destination. +- **Finding ID:** `fba18730143d6ee7` + +### 3. Client offers broken cipher suites + +- **Severity:** LOW · **Confidence:** high · **Category:** tls_weakness · **Detector:** TlsWeaknessDetector +- **📍 Sources:** + - Packet #4086 · 2026-07-08 08:43:36 UTC · 10.12.0.102 → 17.167.200.74 · tls:443 · Capture old_init-2d7aed437f3d.pcapng +- **Risk:** The client advertises cipher suites with known weaknesses. A downgrade or a misconfigured server could select one of them. +- **Affected:** Source 10.12.0.102, Destination 17.167.200.74, tls:443, gsp85-ssl.ls.apple.com +- **Additional evidence:** Packets: 4086 | Time: 2026-07-08 08:43:36 UTC – 2026-07-08 08:43:36 UTC | weak_ciphers=['TLS_ECDHE_ECDSA_WITH_3DES_EDE_CBC_SHA (3DES (Sweet32))', 'TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA (3DES (Sweet32))', 'TLS_RSA_WITH_3DES_EDE_CBC_SHA (3DES (Sweet32))'], offered_total=20, target=gsp85-ssl.ls.apple.com, device_related=False +- **Recommendation:** Remove obsolete cipher suites from the client's TLS configuration. +- **Finding ID:** `9edddf1d281cdabd` + +### 4. DNS sent directly to an external resolver (8.8.8.8) + +- **Severity:** LOW · **Confidence:** high · **Category:** dns_anomaly · **Detector:** DnsAnomalyDetector +- **📍 Sources:** + - Packet #1020 · 2026-07-08 08:41:06 UTC · 10.12.0.200 → 8.8.8.8 · dns:53 · Capture old_init-2d7aed437f3d.pcapng +- **Risk:** The host resolves names through a hard-coded external resolver instead of the one assigned by the network. Local DNS filtering and monitoring are bypassed and the queries are visible to a third party. +- **Affected:** Source 10.12.0.200, Destination 8.8.8.8, dns:53 +- **Additional evidence:** Packets: 1020 | Time: 2026-07-08 08:41:06 UTC – 2026-07-08 08:41:06 UTC | queries=12, device_related=False +- **Recommendation:** Use the DHCP-assigned resolver, or DNS over TLS/HTTPS if privacy is required. +- **Finding ID:** `b90cea9473b87e9a` + +### 5. Randomly-structured DNS name observed + +- **Severity:** LOW · **Confidence:** low · **Category:** dns_anomaly · **Detector:** DnsAnomalyDetector +- **🔎 Observed artifact:** `Domain: intercom.com` +- **📍 Sources:** + - Packet #1020 · 10.12.0.200 → 8.8.8.8 · dns:53 · Capture old_init-2d7aed437f3d.pcapng + - Packet #1021 · 10.12.0.200 → 8.8.8.8 · dns:53 · Capture old_init-2d7aed437f3d.pcapng + - Packet #6965 · 10.12.0.200 → 8.8.8.8 · dns:53 · Capture old_init-2d7aed437f3d.pcapng + - Packet #6966 · 10.12.0.200 → 8.8.8.8 · dns:53 · Capture old_init-2d7aed437f3d.pcapng +- **Risk:** A DNS name with a random-looking label was queried under intercom.com. In isolation this is a weak indicator; it becomes significant only alongside many such names or other anomalies. +- **Affected:** Source 10.12.0.200, Destination 8.8.8.8, dns:53, intercom.com +- **Additional evidence:** Packets: 1020, 1021, 6965, 6966 | Time: 2026-07-08 08:41:06 UTC – 2026-07-08 08:41:06 UTC | registered_domain=intercom.com, distinct_random_subdomains=1, examples=['n1cez2fg-android.mobile-messenger'], device_related=False +- **Recommendation:** Confirm the domain is a legitimate service; otherwise check it against threat intelligence. +- **Finding ID:** `26d5761b2c0d5e1c` + +### 6. Device offers a network service on port 443 + +- **Severity:** INFO · **Confidence:** high · **Category:** insecure_protocol · **Detector:** InsecureProtocolDetector +- **📍 Sources:** + - ? → 34.155.200.196 · tls:443 · Capture old_init-2d7aed437f3d.pcapng · aggregated evidence; no single packet is available +- **Risk:** The device accepted connections on this port. Every listening service is attack surface and should be known and justified. +- **Affected:** Device 34.155.200.196, Destination 34.155.200.196, tls:443 · **involves device under test** +- **Additional evidence:** Time: — – — | port=443, protocols=['tls'], device_related=True +- **Recommendation:** Confirm the service is required, authenticated and encrypted; disable it otherwise. +- **Finding ID:** `9080003b793ca322` + +### 7. Device offers a network service on port 8883 + +- **Severity:** INFO · **Confidence:** high · **Category:** insecure_protocol · **Detector:** InsecureProtocolDetector +- **📍 Sources:** + - ? → 34.155.200.196 · tls:8883 · Capture old_init-2d7aed437f3d.pcapng · aggregated evidence; no single packet is available +- **Risk:** The device accepted connections on this port. Every listening service is attack surface and should be known and justified. +- **Affected:** Device 34.155.200.196, Destination 34.155.200.196, tls:8883 · **involves device under test** +- **Additional evidence:** Time: — – — | port=8883, protocols=['tls'], device_related=True +- **Recommendation:** Confirm the service is required, authenticated and encrypted; disable it otherwise. +- **Finding ID:** `e033c2ed522bde4e` + + +## Observation Inventory + +- Capture: 12383 packets, 331.027 s, 10 internal and 37 external hosts, 410 flows, VLANs 1, 200 · extractor tshark 4.4.19 + +### Device under test +- `34.155.200.196` · MAC 52:54:00:71:bb:02 · names — +- 9968 packets · sent 1.4 MB · received 736.6 kB · first seen 2026-07-08 08:40:37 UTC · last seen 2026-07-08 08:46:01 UTC +- Services offered: 443, 8883 · ports contacted: — +- Protocols: tls · TLS sessions: 0 · clear-text flows: 0 +- Peers (2): + - `10.12.0.103` · internal · ports 33854, 33856, 33870, 33876, 33880, 33896, 33912, 33922, 33926, 33940, 33956, 33960, 33970, 33982, 33996, 34002, 34016, 34020, 34032, 34038 · tls · to peer 1.4 MB / from peer 732.2 kB + - `10.12.0.104` (loqed-8c4b146a1acc._http._tcp.local) · internal · ports 50167 · tls · to peer 6.7 kB / from peer 4.5 kB + +### Internal hosts (10) +- `10.12.0.103` · MAC 6e:bd:64:d7:9a:69 · 11149 packets · offers 33054, 53758, 53770, 53772, 53778, 53794, 53808, 55340 · 19 external endpoints +- `10.12.0.102` (iphone) · MAC d6:cd:eb:e5:d1:75 · 697 packets · offers — · 14 external endpoints +- `10.12.0.104` (loqed-8c4b146a1acc) · MAC 8c:4b:14:6a:1a:cc · 275 packets · offers — · 3 external endpoints +- `10.12.0.250` · MAC 52:54:00:71:bb:02 · 106 packets · offers 53 · 0 external endpoints +- `fe80::10f6:c22e:fe1c:d27a` (iphone) · MAC d6:cd:eb:e5:d1:75 · 63 packets · offers — · 0 external endpoints +- `10.12.0.200` · MAC c8:7f:54:de:c0:38 · 42 packets · offers — · 1 external endpoints +- `fe80::6cbd:64ff:fed7:9a69` · MAC 6e:bd:64:d7:9a:69 · 39 packets · offers — · 0 external endpoints +- `fe80::ca7f:54ff:fede:c038` · MAC c8:7f:54:de:c0:38 · 4 packets · offers — · 0 external endpoints +- `192.168.42.75` · MAC — · 4 packets · offers — · 0 external endpoints +- `10.12.0.101` · MAC — · 2 packets · offers — · 1 external endpoints + +### External endpoints (37) +- `34.155.200.196` (api.production.loqed.com, mqtt.production.loqed.com) · ports 443, 8883 · tls · encrypted · out 736.6 kB / in 1.4 MB +- `17.253.57.197` (captive.apple.com, cl2.apple.com) · ports 443 · tls · encrypted · out 8.6 kB / in 251.1 kB +- `216.239.36.223` (discover-pa.googleapis.com, play.googleapis.com, prod-lt-playstoregatewayadapter-pa.googleapis.com, remoteprovisioning.googleapis.com, spot-pa.googleapis.com) · ports 443 · quic, tls · encrypted · out 54.2 kB / in 179.6 kB +- `142.251.127.101` (encrypted-tbn0.gstatic.com) · ports 443 · tls · encrypted · out 16.0 kB / in 207.8 kB +- `142.251.152.119` (www.google.com) · ports 443 · tls · encrypted · out 5.4 kB / in 95.1 kB +- `142.251.110.95` (www.googleapis.com) · ports 443 · quic, tls · encrypted · out 10.8 kB / in 88.9 kB +- `142.251.13.113` (encrypted-tbn1.gstatic.com) · ports 443 · tls · encrypted · out 7.1 kB / in 33.2 kB +- `142.250.154.139` (encrypted-tbn3.gstatic.com) · ports 443 · tls · encrypted · out 6.4 kB / in 16.7 kB +- `17.57.146.56` (25-courier.push.apple.com, courier.push.apple.com) · ports 5223 · tls · encrypted · out 16.8 kB / in 6.1 kB +- `199.232.191.6` (bag.itunes.apple.com) · ports 443 · quic, tls · encrypted · out 6.0 kB / in 16.5 kB +- `216.239.38.223` (discover-pa.googleapis.com, play.googleapis.com, prod-lt-playstoregatewayadapter-pa.googleapis.com, remoteprovisioning.googleapis.com, spot-pa.googleapis.com) · ports 443 · quic, tls · encrypted · out 11.7 kB / in 10.1 kB +- `40.104.206.18` (m.hotmail.com) · ports 443 · quic, tls · encrypted · out 7.1 kB / in 14.1 kB +- `98.90.70.94` (n1cez2fg-android.mobile-messenger.intercom.com) · ports 443 · tls · encrypted · out 4.8 kB / in 15.6 kB +- `17.248.209.81` (gateway.icloud.com) · ports 443, 61000 · icmp, quic, tls · encrypted · out 11.4 kB / in 8.6 kB +- `216.239.34.223` (discover-pa.googleapis.com, play.googleapis.com, prod-lt-playstoregatewayadapter-pa.googleapis.com, remoteprovisioning.googleapis.com, spot-pa.googleapis.com) · ports 443 · tls · encrypted · out 5.6 kB / in 10.6 kB +- `172.224.55.5` (mask.icloud.com) · ports 443 · quic, tls · encrypted · out 8.3 kB / in 7.8 kB +- `54.144.197.43` (n1cez2fg-android.mobile-messenger.intercom.com) · ports 443 · tls · encrypted · out 3.7 kB / in 9.2 kB +- `17.188.143.125` (init.push.apple.com) · ports 443 · tls · encrypted · out 2.5 kB / in 8.1 kB +- `17.253.57.195` (captive.apple.com, cl2.apple.com) · ports 443 · tls · encrypted · out 2.4 kB / in 7.5 kB +- `17.253.15.139` (configuration.ls.apple.com) · ports 443 · tls · encrypted · out 2.8 kB / in 6.7 kB +- `17.167.200.74` (gsp85-ssl.ls.apple.com) · ports 443 · tls · encrypted · out 3.0 kB / in 5.8 kB +- `18.97.36.75` (nexus-websocket-a.intercom.io) · ports 443 · tls · encrypted · out 2.2 kB / in 6.5 kB +- `2.16.16.110` (gspe1-ssl.ls.apple.com) · ports 443 · tls · encrypted · out 3.8 kB / in 4.9 kB +- `63.181.149.124` (hooks.nabu.casa) · ports 443 · tls · encrypted · out 1.9 kB / in 5.6 kB +- `142.250.154.94` (connectivitycheck.gstatic.com) · ports 80, 443 · http, tls · encrypted · out 2.1 kB / in 4.6 kB +- `142.251.20.113` · ports 443 · tls · encrypted · out 3.4 kB / in 2.4 kB +- `40.101.70.194` (m.hotmail.com) · ports 443 · quic, tls · encrypted · out 2.4 kB / in 1.2 kB +- `52.97.105.162` (m.hotmail.com) · ports 443 · quic, tls · encrypted · out 2.4 kB / in 1.2 kB +- `40.101.69.226` (m.hotmail.com) · ports 443 · quic, tls · encrypted · out 2.4 kB / in 1.2 kB +- `8.8.8.8` · ports 53, 59560 · dns, icmp · clear-text or unknown · out 1.2 kB / in 1.9 kB +- `142.251.157.119` (www.google.com) · ports 443 · tls · encrypted · out 1.5 kB / in 1.6 kB +- `18.97.36.19` · ports 443 · tls · encrypted · out 350 B / in 446 B +- `142.251.127.188` · ports 5228 · tls · encrypted · out 166 B / in 164 B +- `31.13.84.49` · ports 5222 · undecoded · clear-text or unknown · out 0 B / in 236 B +- `3.91.171.254` · ports 443 · tls · encrypted · out 164 B / in 58 B +- `91.206.8.34` (pool.ntp.org) · ports 123 · ntp · clear-text or unknown · out 94 B / in 94 B +- `142.251.156.119` (www.google.com) · ports 443 · undecoded · clear-text or unknown · out 70 B / in 58 B + +### Services observed (45) +- `34.155.200.196:443` https (tcp) ← device · encrypted · 277 flows from 1 clients +- `34.155.200.196:8883` mqtts (tcp) ← device · encrypted · 1 flows from 1 clients +- `10.12.0.102:443` https (udp) · unknown · 1 flows from 1 clients +- `10.12.0.200:53` dns (udp) · unknown · 6 flows from 2 clients +- `10.12.0.250:53` dns (udp) · unknown · 48 flows from 4 clients +- `142.250.154.139:443` https (tcp) · encrypted · 2 flows from 1 clients +- `142.250.154.94:80` http (tcp) · clear-text · 1 flows from 1 clients +- `142.250.154.94:443` https (tcp) · encrypted · 1 flows from 1 clients +- `142.251.110.95:443` quic (udp) · encrypted · 1 flows from 1 clients +- `142.251.127.101:443` https (tcp) · encrypted · 4 flows from 1 clients +- `142.251.127.188:5228` gcm (tcp) · encrypted · 1 flows from 1 clients +- `142.251.13.113:443` https (tcp) · encrypted · 2 flows from 1 clients +- `142.251.152.119:443` https (tcp) · encrypted · 1 flows from 1 clients +- `142.251.156.119:443` https (tcp) · unknown · 1 flows from 1 clients +- `142.251.157.119:443` https (tcp) · encrypted · 1 flows from 1 clients +- `142.251.20.113:443` https (tcp) · encrypted · 5 flows from 1 clients +- `17.167.200.74:443` https (tcp) · encrypted · 1 flows from 1 clients +- `17.188.143.125:443` https (tcp) · encrypted · 1 flows from 1 clients +- `17.248.209.81:443` quic (udp) · encrypted · 1 flows from 1 clients +- `17.253.15.139:443` https (tcp) · encrypted · 1 flows from 1 clients +- `17.253.57.195:443` https (tcp) · encrypted · 1 flows from 1 clients +- `17.253.57.197:443` https (tcp) · encrypted · 1 flows from 1 clients +- `17.57.146.56:5223` apns (tcp) · encrypted · 1 flows from 1 clients +- `172.224.55.5:443` quic (udp) · encrypted · 1 flows from 1 clients +- `172.224.55.5:443` https (tcp) · encrypted · 1 flows from 1 clients +- `18.97.36.19:443` https (tcp) · encrypted · 1 flows from 1 clients +- `18.97.36.75:443` https (tcp) · encrypted · 1 flows from 1 clients +- `199.232.191.6:443` quic (udp) · encrypted · 1 flows from 1 clients +- `2.16.16.110:443` https (tcp) · encrypted · 1 flows from 1 clients +- `216.239.34.223:443` https (tcp) · encrypted · 7 flows from 1 clients +- `216.239.36.223:443` quic (udp) · encrypted · 2 flows from 1 clients +- `216.239.38.223:443` https (tcp) · encrypted · 2 flows from 1 clients +- `216.239.38.223:443` quic (udp) · encrypted · 1 flows from 1 clients +- `3.91.171.254:443` https (tcp) · encrypted · 1 flows from 1 clients +- `31.13.84.49:5222` xmpp (tcp) · unknown · 1 flows from 1 clients +- `40.101.69.226:443` quic (udp) · encrypted · 1 flows from 1 clients +- `40.101.70.194:443` quic (udp) · encrypted · 1 flows from 1 clients +- `40.104.206.18:443` quic (udp) · encrypted · 1 flows from 1 clients +- `40.104.206.18:443` https (tcp) · encrypted · 1 flows from 1 clients +- `52.97.105.162:443` quic (udp) · encrypted · 1 flows from 1 clients +- `54.144.197.43:443` https (tcp) · encrypted · 1 flows from 1 clients +- `63.181.149.124:443` https (tcp) · encrypted · 1 flows from 1 clients +- `8.8.8.8:53` dns (udp) · unknown · 12 flows from 1 clients +- `91.206.8.34:123` ntp (udp) · unknown · 1 flows from 1 clients +- `98.90.70.94:443` https (tcp) · encrypted · 1 flows from 1 clients + +### Protocols (packets) +- ip 12180, tcp 11373, tls 5469, udp 879, quic 541, mdns 189, dns 126, ipv6 115, arp 79, icmpv6 28, dhcp 20, igmp 15, icmp 7, ipv6.hopopts 6, http 2, ntp 2 +- ICMP: router_advertisement 3, unreachable 7, router_solicitation 12, neighbor_solicitation 6, icmpv6_type_143 6, neighbor_advertisement 1 + +### TLS posture (320 handshakes) +- Versions: TLS 1.2 ×285, TLS 1.3 ×30 +- Cipher suites: TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256 ×284, TLS_AES_128_GCM_SHA256 ×12, TLS_AES_256_GCM_SHA384 ×18, TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256 ×1 +- 10.12.0.103 → `34.155.200.196:443` (api.production.loqed.com) ← device · TLS 1.2 · TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256 · client max TLS 1.2 · cert api.production.loqed.com by YR1, expires 2026-10-02 03:13:03 UTC +- 10.12.0.103 → `34.155.200.196:443` (api.production.loqed.com) ← device · TLS 1.2 · TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256 · client max TLS 1.2 · cert api.production.loqed.com by YR1, expires 2026-10-02 03:13:03 UTC +- 10.12.0.103 → `34.155.200.196:443` (api.production.loqed.com) ← device · TLS 1.2 · TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256 · client max TLS 1.2 · cert api.production.loqed.com by YR1, expires 2026-10-02 03:13:03 UTC +- 10.12.0.103 → `34.155.200.196:443` (api.production.loqed.com) ← device · TLS 1.2 · TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256 · client max TLS 1.2 · cert api.production.loqed.com by YR1, expires 2026-10-02 03:13:03 UTC +- 10.12.0.103 → `34.155.200.196:443` (api.production.loqed.com) ← device · TLS 1.2 · TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256 · client max TLS 1.2 +- 10.12.0.103 → `34.155.200.196:443` (api.production.loqed.com) ← device · TLS 1.2 · TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256 · client max TLS 1.2 · cert api.production.loqed.com by YR1, expires 2026-10-02 03:13:03 UTC +- 10.12.0.103 → `34.155.200.196:443` (api.production.loqed.com) ← device · TLS 1.2 · TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256 · client max TLS 1.2 · cert api.production.loqed.com by YR1, expires 2026-10-02 03:13:03 UTC +- 10.12.0.103 → `34.155.200.196:443` (api.production.loqed.com) ← device · TLS 1.2 · TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256 · client max TLS 1.2 · cert api.production.loqed.com by YR1, expires 2026-10-02 03:13:03 UTC +- 10.12.0.103 → `34.155.200.196:443` (api.production.loqed.com) ← device · TLS 1.2 · TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256 · client max TLS 1.2 · cert api.production.loqed.com by YR1, expires 2026-10-02 03:13:03 UTC +- 10.12.0.103 → `34.155.200.196:443` (api.production.loqed.com) ← device · TLS 1.2 · TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256 · client max TLS 1.2 · cert api.production.loqed.com by YR1, expires 2026-10-02 03:13:03 UTC +- 10.12.0.103 → `34.155.200.196:443` (api.production.loqed.com) ← device · TLS 1.2 · TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256 · client max TLS 1.2 · cert api.production.loqed.com by YR1, expires 2026-10-02 03:13:03 UTC +- 10.12.0.103 → `34.155.200.196:443` (api.production.loqed.com) ← device · TLS 1.2 · TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256 · client max TLS 1.2 · cert api.production.loqed.com by YR1, expires 2026-10-02 03:13:03 UTC +- 10.12.0.103 → `34.155.200.196:443` (api.production.loqed.com) ← device · TLS 1.2 · TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256 · client max TLS 1.2 · cert api.production.loqed.com by YR1, expires 2026-10-02 03:13:03 UTC +- 10.12.0.103 → `34.155.200.196:443` (api.production.loqed.com) ← device · TLS 1.2 · TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256 · client max TLS 1.2 · cert api.production.loqed.com by YR1, expires 2026-10-02 03:13:03 UTC +- 10.12.0.103 → `34.155.200.196:443` (api.production.loqed.com) ← device · TLS 1.2 · TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256 · client max TLS 1.2 +- 10.12.0.103 → `34.155.200.196:443` (api.production.loqed.com) ← device · TLS 1.2 · TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256 · client max TLS 1.2 · cert api.production.loqed.com by YR1, expires 2026-10-02 03:13:03 UTC +- 10.12.0.103 → `34.155.200.196:443` (api.production.loqed.com) ← device · TLS 1.2 · TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256 · client max TLS 1.2 · cert api.production.loqed.com by YR1, expires 2026-10-02 03:13:03 UTC +- 10.12.0.103 → `34.155.200.196:443` (api.production.loqed.com) ← device · TLS 1.2 · TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256 · client max TLS 1.2 · cert api.production.loqed.com by YR1, expires 2026-10-02 03:13:03 UTC +- 10.12.0.103 → `34.155.200.196:443` (api.production.loqed.com) ← device · TLS 1.2 · TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256 · client max TLS 1.2 · cert api.production.loqed.com by YR1, expires 2026-10-02 03:13:03 UTC +- 10.12.0.103 → `34.155.200.196:443` (api.production.loqed.com) ← device · TLS 1.2 · TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256 · client max TLS 1.2 · cert api.production.loqed.com by YR1, expires 2026-10-02 03:13:03 UTC +- 10.12.0.103 → `34.155.200.196:443` (api.production.loqed.com) ← device · TLS 1.2 · TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256 · client max TLS 1.2 · cert api.production.loqed.com by YR1, expires 2026-10-02 03:13:03 UTC +- 10.12.0.103 → `34.155.200.196:443` (api.production.loqed.com) ← device · TLS 1.2 · TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256 · client max TLS 1.2 +- 10.12.0.103 → `34.155.200.196:443` (api.production.loqed.com) ← device · TLS 1.2 · TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256 · client max TLS 1.2 · cert api.production.loqed.com by YR1, expires 2026-10-02 03:13:03 UTC +- 10.12.0.103 → `34.155.200.196:443` (api.production.loqed.com) ← device · TLS 1.2 · TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256 · client max TLS 1.2 · cert api.production.loqed.com by YR1, expires 2026-10-02 03:13:03 UTC +- 10.12.0.103 → `34.155.200.196:443` (api.production.loqed.com) ← device · TLS 1.2 · TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256 · client max TLS 1.2 · cert api.production.loqed.com by YR1, expires 2026-10-02 03:13:03 UTC +- 10.12.0.103 → `34.155.200.196:443` (api.production.loqed.com) ← device · TLS 1.2 · TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256 · client max TLS 1.2 +- 10.12.0.103 → `34.155.200.196:443` (api.production.loqed.com) ← device · TLS 1.2 · TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256 · client max TLS 1.2 +- 10.12.0.103 → `34.155.200.196:443` (api.production.loqed.com) ← device · TLS 1.2 · TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256 · client max TLS 1.2 +- 10.12.0.103 → `34.155.200.196:443` (api.production.loqed.com) ← device · TLS 1.2 · TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256 · client max TLS 1.2 +- 10.12.0.103 → `34.155.200.196:443` (api.production.loqed.com) ← device · TLS 1.2 · TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256 · client max TLS 1.2 · cert api.production.loqed.com by YR1, expires 2026-10-02 03:13:03 UTC + +### DNS (129 queries, 66 responses, 46 names) +- Response codes: NOERROR 60, NXDOMAIN 6 · resolvers: 8.8.8.8 (12), 10.12.0.250 (48), 10.12.0.200 (6) +- `_rdlink._tcp.local` · 21× · PTR · no answer seen +- `1225c5c3-e802-4057-a9d9-4c2aa8527e4d._asquic._udp.local` · 18× · ANY · no answer seen +- `i0jzqvr8n14aaa._fc9f5ed42c8a._tcp.local` · 18× · ANY · no answer seen +- `loqed-8c4b146a1acc._http._tcp.local` · 12× · ANY · no answer seen +- `n1cez2fg-android.mobile-messenger.intercom.com` · 4× · A · 100.60.6.237, 107.20.239.244, 52.70.57.139, 54.144.197.43, 54.210.239.62, 98.90.70.94 +- `www.google.com` · 3× · A · 142.251.150.119, 142.251.151.119, 142.251.152.119, 142.251.153.119, 142.251.154.119, 142.251.155.119 +- `25-courier.push.apple.com` · 2× · A, HTTPS · 17.57.146.54, 17.57.146.55, 17.57.146.56, 17.57.146.57, 17.57.146.58, 17.57.146.59 +- `bag.itunes.apple.com` · 2× · A, HTTPS · 199.232.191.6 +- `captive.apple.com` · 2× · A, HTTPS · 17.253.57.195, 17.253.57.197 +- `cl2.apple.com` · 2× · A, HTTPS · 17.253.57.195, 17.253.57.197 +- `configuration.ls.apple.com` · 2× · A, HTTPS · 17.253.15.139, 17.253.15.147 +- `connectivitycheck.gstatic.com` · 2× · A · 142.250.154.94, 142.251.20.94 +- `gsp85-ssl.ls.apple.com` · 2× · A, HTTPS · 17.167.200.74 +- `gspe1-ssl.ls.apple.com` · 2× · A, HTTPS · 2.16.16.100, 2.16.16.110 +- `init.push.apple.com` · 2× · A, HTTPS · 17.188.143.125, 17.188.143.126, 17.188.143.189, 17.188.178.226, 17.188.178.34, 17.188.179.2 +- `m.hotmail.com` · 2× · A, HTTPS · 40.101.69.226, 40.101.70.194, 40.104.206.18, 52.97.105.162 +- `mask.icloud.com` · 2× · A, HTTPS · 172.224.55.10, 172.224.55.11, 172.224.55.13, 172.224.55.4, 172.224.55.5, 172.224.55.7 +- `nexus-websocket-a.intercom.io` · 2× · A · 18.97.36.13, 18.97.36.14, 18.97.36.18, 18.97.36.2, 18.97.36.47, 18.97.36.49 +- `www.googleapis.com` · 2× · A · 142.250.154.95, 142.251.110.95, 142.251.127.95, 142.251.13.95, 142.251.14.95, 142.251.20.95 +- `_dns.resolver.arpa` · 1× · SVCB · no answer seen +- `a1366.dscapi6.akamai.net` · 1× · HTTPS · no answer seen +- `api.production.loqed.com` · 1× · A · 34.155.200.196 +- `captive.g.aaplimg.com` · 1× · HTTPS · no answer seen +- `cl2.g.aaplimg.com` · 1× · HTTPS · no answer seen +- `configuration.ls.v.aaplimg.com` · 1× · HTTPS · no answer seen +- `discover-pa.googleapis.com` · 1× · A · 216.239.32.223, 216.239.34.223, 216.239.36.223, 216.239.38.223 +- `encrypted-tbn0.gstatic.com` · 1× · A · 142.251.127.100, 142.251.127.101, 142.251.127.102, 142.251.127.113, 142.251.127.138, 142.251.127.139 +- `encrypted-tbn1.gstatic.com` · 1× · A · 142.251.13.100, 142.251.13.101, 142.251.13.102, 142.251.13.113, 142.251.13.138, 142.251.13.139 +- `encrypted-tbn3.gstatic.com` · 1× · A · 142.250.154.100, 142.250.154.101, 142.250.154.102, 142.250.154.113, 142.250.154.138, 142.250.154.139 +- `eu-central-courier-4.push-apple.com.akadns.net` · 1× · HTTPS · no answer seen +- `gsp85-ssl.ls2-apple.com.akadns.net` · 1× · HTTPS · no answer seen +- `hooks.nabu.casa` · 1× · A · 3.73.212.91, 63.181.149.124 +- `init.push-apple.com.akadns.net` · 1× · HTTPS · no answer seen +- `lb._dns-sd._udp.0.0.12.10.in-addr.arpa` · 1× · PTR · no answer seen +- `lb._dns-sd._udp.15.89.76.100.in-addr.arpa` · 1× · PTR · no answer seen +- `lb._dns-sd._udp.56.111.171.10.in-addr.arpa` · 1× · PTR · no answer seen +- `lb._dns-sd._udp.6.0.0.192.in-addr.arpa` · 1× · PTR · no answer seen +- `lb._dns-sd._udp.jrz-iot.mci.edu` · 1× · PTR · no answer seen +- `mask.apple-dns.net` · 1× · HTTPS · no answer seen +- `mqtt.production.loqed.com` · 1× · A · 34.155.200.196 +- `play.googleapis.com` · 1× · A · 216.239.32.223, 216.239.34.223, 216.239.36.223, 216.239.38.223 +- `pool.ntp.org` · 1× · A · 152.53.100.131, 152.53.119.76, 46.102.157.67, 91.206.8.34 +- `prod-lt-playstoregatewayadapter-pa.googleapis.com` · 1× · A · 216.239.32.223, 216.239.34.223, 216.239.36.223, 216.239.38.223 +- `remoteprovisioning.googleapis.com` · 1× · A · 216.239.32.223, 216.239.34.223, 216.239.36.223, 216.239.38.223 +- `spot-pa.googleapis.com` · 1× · A · 216.239.32.223, 216.239.34.223, 216.239.36.223, 216.239.38.223 +- `vie-efz.ms-acdc.office.com` · 1× · HTTPS · no answer seen + +### HTTP (2 requests) +- `connectivitycheck.gstatic.com` · 1 requests · GET · /generate_204 +- `10.12.0.103` · 1 requests · · /generate_204 + +### Clear-text protocols and service events +- http: 1 flows, 373 B · 10.12.0.103 -> 142.250.154.94:80 +- xmpp: 1 flows, 96 B · 10.12.0.101 -> 31.13.84.49:5222 +- https: 1 flows, 21 B · 17.248.209.81 -> 10.12.0.102:443 +- icmpv6 router_advertisement: (fe80::ca7f:54ff:fede:c038 → ff02::1) +- icmpv6 router_advertisement: (fe80::ca7f:54ff:fede:c038 → ff02::1) +- icmpv6 router_advertisement: (fe80::ca7f:54ff:fede:c038 → ff02::1) +- DHCP request: d6:cd:eb:e5:d1:75 iPhone → 10.12.0.102 (server —) +- DHCP request: d6:cd:eb:e5:d1:75 iPhone → 10.12.0.102 (server —) +- DHCP request: d6:cd:eb:e5:d1:75 iPhone → 10.12.0.102 (server —) +- DHCP ack: d6:cd:eb:e5:d1:75 iphone → 10.12.0.102 (server 10.12.0.250) +- DHCP discover: 8c:4b:14:6a:1a:cc LOQED-8c4b146a1acc → (server —) +- DHCP discover: 8c:4b:14:6a:1a:cc LOQED-8c4b146a1acc → (server —) +- DHCP discover: 8c:4b:14:6a:1a:cc LOQED-8c4b146a1acc → (server —) +- DHCP offer: 8c:4b:14:6a:1a:cc loqed-8c4b146a1acc → 10.12.0.104 (server 10.12.0.250) +- DHCP request: 8c:4b:14:6a:1a:cc LOQED-8c4b146a1acc → 10.12.0.104 (server 10.12.0.250) +- DHCP request: 8c:4b:14:6a:1a:cc LOQED-8c4b146a1acc → 10.12.0.104 (server 10.12.0.250) +- DHCP request: 8c:4b:14:6a:1a:cc LOQED-8c4b146a1acc → 10.12.0.104 (server 10.12.0.250) +- DHCP ack: 8c:4b:14:6a:1a:cc loqed-8c4b146a1acc → 10.12.0.104 (server 10.12.0.250) +- DHCP discover: 8c:4b:14:6a:1a:cc LOQED-8c4b146a1acc → (server —) +- DHCP discover: 8c:4b:14:6a:1a:cc LOQED-8c4b146a1acc → (server —) +- DHCP discover: 8c:4b:14:6a:1a:cc LOQED-8c4b146a1acc → (server —) +- DHCP offer: 8c:4b:14:6a:1a:cc loqed-8c4b146a1acc → 10.12.0.104 (server 10.12.0.250) +- DHCP request: 8c:4b:14:6a:1a:cc LOQED-8c4b146a1acc → 10.12.0.104 (server 10.12.0.250) +- DHCP request: 8c:4b:14:6a:1a:cc LOQED-8c4b146a1acc → 10.12.0.104 (server 10.12.0.250) +- DHCP request: 8c:4b:14:6a:1a:cc LOQED-8c4b146a1acc → 10.12.0.104 (server 10.12.0.250) +- DHCP ack: 8c:4b:14:6a:1a:cc loqed-8c4b146a1acc → 10.12.0.104 (server 10.12.0.250) + +### Coverage +- Complete extraction · 410 flows, 330 encrypted, 1 with undecoded payload · 4 clear-text payloads scanned +- Undecoded ports (flows): 5222: 1 +- Flows with application data that tshark did not decode (port: flows): 5222: 1 +- 30 TLS 1.3 sessions: server certificates are encrypted and could not be inspected. + +## Cloud URLs and Endpoints (54) + +- `1225c5c3-e802-4057-a9d9-4c2aa8527e4d._asquic._udp.local` — Ports: —; TLS: N/A; Cipher: N/A +- `142.251.127.188` — Ports: 443, 5228; TLS: N/A; Cipher: N/A +- `142.251.20.113` — Ports: 80, 443; TLS: N/A; Cipher: N/A +- `18.97.36.19` — Ports: —; TLS: N/A; Cipher: N/A +- `25-courier.push.apple.com` — Ports: 443; TLS: N/A; Cipher: N/A +- `3.91.171.254` — Ports: 443; TLS: N/A; Cipher: N/A +- `31.13.84.49` — Ports: 80, 443, 5222; TLS: N/A; Cipher: N/A +- `8.8.8.8` — Ports: 53, 443; TLS: TLSv1.3; Cipher: TLS_AES_256_GCM_SHA384 +- `_dns.resolver.arpa` — Ports: —; TLS: N/A; Cipher: N/A +- `_rdlink._tcp.local` — Ports: —; TLS: N/A; Cipher: N/A +- `a1366.dscapi6.akamai.net` — Ports: 80, 443; TLS: N/A; Cipher: N/A +- `api.production.loqed.com` — Ports: 80, 443, 8080; TLS: TLSv1.3; Cipher: TLS_AES_128_GCM_SHA256 +- `bag.itunes.apple.com` — Ports: 80, 443; TLS: TLSv1.3; Cipher: TLS_AES_256_GCM_SHA384 +- `captive.apple.com` — Ports: 80, 443; TLS: TLSv1.3; Cipher: TLS_AES_256_GCM_SHA384 +- `captive.g.aaplimg.com` — Ports: 80, 443; TLS: N/A; Cipher: N/A +- `cl2.apple.com` — Ports: 80, 443; TLS: N/A; Cipher: N/A +- `cl2.g.aaplimg.com` — Ports: 80, 443; TLS: N/A; Cipher: N/A +- `configuration.ls.apple.com` — Ports: 80, 443; TLS: TLSv1.3; Cipher: TLS_AES_256_GCM_SHA384 +- `configuration.ls.v.aaplimg.com` — Ports: 80, 443; TLS: N/A; Cipher: N/A +- `connectivitycheck.gstatic.com` — Ports: 80, 443; TLS: TLSv1.3; Cipher: TLS_AES_256_GCM_SHA384 +- `courier.push.apple.com` — Ports: 443, 5223; TLS: TLSv1.3; Cipher: TLS_AES_256_GCM_SHA384 +- `discover-pa.googleapis.com` — Ports: 80, 443; TLS: TLSv1.3; Cipher: TLS_AES_256_GCM_SHA384 +- `encrypted-tbn0.gstatic.com` — Ports: 80, 443; TLS: TLSv1.3; Cipher: TLS_AES_256_GCM_SHA384 +- `encrypted-tbn1.gstatic.com` — Ports: 80, 443; TLS: TLSv1.3; Cipher: TLS_AES_256_GCM_SHA384 +- `encrypted-tbn3.gstatic.com` — Ports: 80, 443; TLS: TLSv1.3; Cipher: TLS_AES_256_GCM_SHA384 +- `eu-central-courier-4.push-apple.com.akadns.net` — Ports: 443; TLS: N/A; Cipher: N/A +- `gateway.icloud.com` — Ports: 80, 443; TLS: TLSv1.3; Cipher: TLS_AES_256_GCM_SHA384 +- `gsp85-ssl.ls.apple.com` — Ports: 80, 443; TLS: TLSv1.3; Cipher: TLS_AES_256_GCM_SHA384 +- `gsp85-ssl.ls2-apple.com.akadns.net` — Ports: 80, 443; TLS: N/A; Cipher: N/A +- `gspe1-ssl.ls.apple.com` — Ports: 80, 443; TLS: TLSv1.3; Cipher: TLS_AES_256_GCM_SHA384 +- `hooks.nabu.casa` — Ports: 443, 8000; TLS: TLSv1.2; Cipher: ECDHE-RSA-AES128-GCM-SHA256 +- `i0jzqvr8n14aaa._fc9f5ed42c8a._tcp.local` — Ports: —; TLS: N/A; Cipher: N/A +- `init.push-apple.com.akadns.net` — Ports: 443; TLS: N/A; Cipher: N/A +- `init.push.apple.com` — Ports: 443; TLS: N/A; Cipher: N/A +- `lb._dns-sd._udp.0.0.12.10.in-addr.arpa` — Ports: —; TLS: N/A; Cipher: N/A +- `lb._dns-sd._udp.15.89.76.100.in-addr.arpa` — Ports: —; TLS: N/A; Cipher: N/A +- `lb._dns-sd._udp.56.111.171.10.in-addr.arpa` — Ports: —; TLS: N/A; Cipher: N/A +- `lb._dns-sd._udp.6.0.0.192.in-addr.arpa` — Ports: —; TLS: N/A; Cipher: N/A +- `lb._dns-sd._udp.jrz-iot.mci.edu` — Ports: —; TLS: N/A; Cipher: N/A +- `loqed-8c4b146a1acc._http._tcp.local` — Ports: —; TLS: N/A; Cipher: N/A +- `m.hotmail.com` — Ports: 80, 443; TLS: TLSv1.3; Cipher: TLS_AES_256_GCM_SHA384 +- `mask.apple-dns.net` — Ports: 80, 443; TLS: N/A; Cipher: N/A +- `mask.icloud.com` — Ports: 80, 443; TLS: N/A; Cipher: N/A +- `mqtt.production.loqed.com` — Ports: 80, 443, 8080, 8883; TLS: TLSv1.3; Cipher: TLS_AES_128_GCM_SHA256 +- `n1cez2fg-android.mobile-messenger.intercom.com` — Ports: 443; TLS: TLSv1.3; Cipher: TLS_AES_128_GCM_SHA256 +- `nexus-websocket-a.intercom.io` — Ports: 443; TLS: TLSv1.3; Cipher: TLS_AES_256_GCM_SHA384 +- `play.googleapis.com` — Ports: 80, 443; TLS: TLSv1.3; Cipher: TLS_AES_256_GCM_SHA384 +- `pool.ntp.org` — Ports: 22; TLS: N/A; Cipher: N/A +- `prod-lt-playstoregatewayadapter-pa.googleapis.com` — Ports: 80, 443; TLS: TLSv1.3; Cipher: TLS_AES_256_GCM_SHA384 +- `remoteprovisioning.googleapis.com` — Ports: 80, 443; TLS: TLSv1.3; Cipher: TLS_AES_256_GCM_SHA384 +- `spot-pa.googleapis.com` — Ports: 80, 443; TLS: TLSv1.3; Cipher: TLS_AES_256_GCM_SHA384 +- `vie-efz.ms-acdc.office.com` — Ports: 80, 443; TLS: N/A; Cipher: N/A +- `www.google.com` — Ports: 80, 443; TLS: TLSv1.3; Cipher: TLS_AES_256_GCM_SHA384 +- `www.googleapis.com` — Ports: 80, 443; TLS: TLSv1.3; Cipher: TLS_AES_256_GCM_SHA384 + +--- +_Generated by IoT PreTester 4.6 · Detectors: PlaintextCredentialDetector, PasswordHashDetector, TokenSecretDetector, MalwareBeaconingDetector, ExfiltrationDetector, MitmDetector, InsecureProtocolDetector, TlsWeaknessDetector, DnsAnomalyDetector, BruteforceScanFileTransferDetector_ \ No newline at end of file