3 ms·
The bank I have been working for the last 12 months was also blocking 443 traffic (except to few "safe" ssl sites). Tunnelling on 443 was impossible.
by koevet 17y ago
The bank I have been working for the last 12 months was also blocking 443 traffic (except to few "safe" ssl sites). Tunnelling on 443 was impossible.
- mhansen 17y agoWhat's the reasoning behind that? Do they want to intercept all communications, and encryption would get in the way of that?
- iuguy 17y agoThere are bots that use SSL for C&C communication over port 443. There's also obligations under certain banking regulations to be able to intercept all communications (e.g. on the dealing floor) and whilst some Internet access may be useful, opening things up too far can cause more problems than it solves.
- koevet 17y agoNo, I guess they figured out that people were tunnelling over 443 and decided to take action.
- blasdel 17y agoIt's not too hard to MITM HTTPS traffic in a corporate setting -- you run your own internal root CA that approves the same cert for all domains, and add its public key to the browsers on all of the company's computers. Then instead of running a normal socks proxy, you just route all external IPs to a gateway box that proxies on 80 and 443. I've seen this proxy method used at a company before, but I'm pretty sure they just passed through the https traffic instead of fucking with the certs. I'll have to check the next time I'm on-site...