Get the latest tech news

Wanted to spy on my dog, ended up spying on TP-Link

I recently bought a cheap Tapo indoor camera to see what my dog gets up to when I am out of the house. What actually followed? I ended up reverse-engineering onboarding flows, decompiling an APK, MITMing TLS sessions, and writing cryptographic scripts.

After spinning up mitmproxy, injecting the frida scripts, and onboarding the camera, we finally see an initial login flow — before the admin password ever gets changed: What this means is that we can pass a python script to mitmproxy, and have it directly decrypt request and response payloads inline whilst running a capture. Watches for the login handshake ( cnonce, nonce, device_confirm) Derives lsk/ ivb session keys from it Transparently decrypts subsequent API calls Pretty-prints them inline in mitmproxy’s UI in request_decrypted and response_decrypted fields Dumps them to JSON files for later analysis

Get the Android app