4 ms·

In this case "endpoint-trusted" mean that it's a CA that is trusted by the client on the local network. What happens is that the box intercepts all traffic and

• toufka 11y ago
  Is there any way to know what CA is being used by the man-in-the-middler, and then revoke its trust on local machines?
  • braythwayt 11y ago
    Likely not. If you are the kind of organization that installs this kind of hardware, you aren’t the kind of organization that permits users to configure their own machines in any substantial way, much less to work around the monitoring you worked so hard to establish. Likewise, if you are that kind of organization, how hard would it be to set up the network such that only traffic from the MiTM hardware is allowed to go through the network? Is there any reason to permit local machines to establish connections outside the network for any reason?
    • superuser2 11y ago
      We're talking about a university. It'd be extremely strange for students and faculty not to use their personal laptops. My university runs like a corporate IT department for its offices, hospital, etc. but for any part of it an undergrad will ever see, IT is just a WiFi-based ISP.
      • lfam 11y ago
        My alma mater required OS X users to install a kernel extension on their personal machines. I assume it wanted to do something like this.
        • superuser2 11y ago
          Wow, what school? That sounds like a totally unacceptable violation of ownership of personal property and a great reason to avoid studying/working there. My employer does that for company-issue laptops (we keep root as long as we accept the rootkit), but for personal ones that's unbelievable.
          • schoen 11y ago
            Stanford has done stuff with requiring people to install particular monitoring software on personal devices in order to access SUNet (the main stated purpose being to ensure that users were running approved anti-malware scanners). I don't know what the current status is.
          • lfam 11y ago
            Looks like I misremembered and it wasn't a kernel extension. It was a product called SafeConnect by Impulse. Based on the instructions I can find, it doesn't seem to require root so it must not be a kernel extension. But on contemporary Unix-y systems like OS X and GNU / Linux, pretty much all your privacy is gone if there is a rogue process running as you. You don't need root. In any case, my attitude was that it was their network and they could put any restrictions on it, although they may be in very bad taste.
            • superuser2 11y ago
              >it was their network and they could put any restrictions on it Would you say the same of Comcast? When it is the only ISP serving the apartment you just signed a lease on? Because that is basically the position of an undergrad in university housing with respect to "their network." You could say they had a choice not to go to that school, but for a state school system? On a network engineering level, something is deeply wrong if you can't separate internet access from access to sensitive resources. Or if you are treating a subnet which includes tens of thousands of students as "trusted."
              • lfam 11y ago
  • azdle 11y ago
    Sure, your browser would tell you who the CA is. In this case it'd tell you that it's a Fidelis cert. And if you have the permissions on your system you could revoke the cert, but I'd be shocked if this system set encrypted traffic, that it couldn't inspect, pass. Your connection would probably just timeout or get some random error about your connection being refused.
    • sjtgraham 11y ago
      It wouldn't be a Fidelis cert, it would be a cert signed by whatever CA is installed on the SSL terminator. What would happen if you locally revoked trust of the CA in question is you would get warnings that the connection is unsafe as you would with any other TLS error, e.g. hostname mismatch, untrusted cert, etc. Depending on the client behaviour you may be able to continue with the connection.
  • Silhouette 11y ago
    This type of security tool typically operates in conjunction with installing some extra authority on client machines (for outgoing connections) and/or in reverse by installing the server's private key/cert information (for incoming connections). Having done so, the device can then effectively MITM the organisation's own traffic. This can be quite effective if you have control of the client machines on your network and can reliably configure them to trust your choice of authorities. For example, this might be true in a university computer lab or in a corporate office where IT staff administer all the machines and staff don't have admin rights to change anything. Now your anti-malware scanners and the like can operate on things like HTTPS traffic in the same way they would on any other connection. It doesn't work if you have other machines that don't have the extra authority installed and therefore don't trust the intermediary. Typically, either you'll just see the same security warnings as you would for any other MITM threat, or they'll block the traffic and you won't be able to connect at all over an unauthorised encrypted link. Either way, all they see will be your encrypted traffic. Clearly it would be rather unfortunate for the entire global security infrastructure if this were not the case... I note in passing that, other things being equal, this kind of technology is a good thing for security. There are more powerful tools available than the kind of antivirus software typically installed on individual workstations, and they are no more necessarily recording HTTPS traffic than any other traffic that they scan. But of course you're still MITMing someone else's traffic, and the person sending that traffic has only your word for it that you're not configuring tools to record the "temporarily" decrypted data stream or otherwise process the data in unexpected ways. There have already been lawsuits about this kind of comprehensive monitoring of network traffic in the workplace. Obviously it can look bad if for example an employee was using what they believed to be an encrypted connection to their bank to check that some legitimately employment-related payment has been received, but because it was from a work computer and intercepted that connection wasn't actually secure. The results haven't been completely one-sided so far; it's a complicated issue, and there are elements of both an employer reasonably wanting to know what is happening with their own IT systems and the reasonable expectations of privacy of an employee to balance.
    • davb 11y ago
      This technique makes certificate pinning that much more important. I assume that it would just lead to cert mismatch errors on clients with pinned certificates, but in almost call cases that would be preferable to being MITM'd.
• wfunction 11y ago
  Are you just making a guess or do you actually know what is happening here? Because from what I've been able to tell so far, what you say is not what is going on here. It seems to be passive monitoring. If you have evidence to the contrary please post it.
  • hueving 11y ago
    Passive monitoring is not possible even if you have the private key for the target cert if diffie hellman is used as a key exchange. Look up perfect forward secrecy for more info.