5 ms·

Do companies really MITM SSL traffic in order to watch employees surfing habits?

by colemickens 10y ago

0942v8653 10y ago
Yes.
deleted 10y ago
[deleted]
archinal 10y ago
You bet they do! In the past I have had to manually install my company's certificates as a root CA. The annoying thing was that the certs they use are expired and use SHA-1, so I also had to explicitly tell my browser to trust expired/unsafe certificates as well. All in the name of increased security!
- terminado 10y ago
  I would quit a job like that, unless there were seriously profound reasons for such a grotesque invasion. 1. There are proper ways to restrict activity without resorting to eavesdropping. 2. If they don't trust you enough to be responsible and use good judgement, you're probably stuck in a dead-end situation anyway. 3. In the more rare scenarios, where you might be operating live-saving or life-threatening equipment, or handling the salaries of many people, and dealing with monentary quantities in the many millions of dollars, guess what? You probably shouldn't be using an ordinary computer, with a web browser connected to the internet to perform those sorts of tasks, within the same operating system environment as ordinary web surfing to begin with.
  - dec0dedab0de 10y ago
    Some companies in highly regulated industries intercept, and inspect all traffic purely because it's easier. Though if this raised a flag, and you showed them what link you clicked, any sane IT department would laugh and start sending the link to their friends.
    - terminado 10y ago
      Other companies (tech compnies, even) engage in ridiculous behavior like timing the minutes of your bathroom breaks, and so forth. Call centers, data entry, tier one support.
recursive 10y ago
Are there really people that believe there's a possibility that they don't?
- colemickens 10y ago
  I'm no security expert, but I was under the impression that HSTS pinning would make that hard to do, especially on sites like google.com. And I can't quite parse your sentence to know if you're implying that all companies do... (or just that I shouldn't be so naive as to assume none are), but I can see the cert chain for google.com in my browser at ${big_company} and it doesn't seem like I'm being MITM'd.
  - sillysaurus3 10y ago
    Rule of thumb: if an adversary has physical access to your computer, treat it as compromised.
    - colemickens 10y ago
      Okay? I'm very familiar with that principle, but I don't understand how to take that statement and apply it to the situation at hand. No one has ever operated this computer except me (though I did enroll the corp wifi certs). So again, how could I be MITM'd without being aware of it, given HSTS? Yes, someone could have snuck in a hacked copy of Chrome Canary that exposes phony cert chain information... but that's not what we were talking about, and I don't think most IT departments have the sophistication required to pull that off.
      - detaro 10y ago
        If you enrolled the wifi certs into your system certificate store, certificates signed by them ignore HSTS, for exactly this use case.
        colemickens 10y ago
        I can't find any information about this. Can you point me at some additional information? Thank you in advance!
mehrdada 10y ago
I am aware of at least one lawsuit against an employee in which the firm has used a Google query an employee made as an evidence.
monknomo 10y ago
Yep, IronPort is one product, but our network guys have been saying something about it being built into the latest Cisco series 6 routers? That's the enterprise life
- deleted 10y ago
  [deleted]
chrisra 10y ago
Sounds like it. Our university web security lab was testing this.
lkrups 10y ago
The search term is in the url.
- colemickens 10y ago
  Which is still not normally visible to an outsider in an HTTPS request... (other than the cases we're discussing in the sub-thread where the company has installed a root CA and is seeing all of the traffic anyway).
- sp332 10y ago
  HTTPS protects everything but the domain name. If you're not using SNI it might protect the domain too.
lucb1e 10y ago
Recently did an on-site pentest at a place that does this (a municipality in the Netherlands). First thing I did was go to https://torproject.org https://torproject.org but of course that was blocked. Eventually I found a third party site that offered old versions and via an obfs proxy and bridge node I could get on the Internet uncensored (lots of sites were blocked). So yup this happens. Is it effective though? No, this took me 15 minutes and I wasn't even an employee with months if not years of time on their hands.

Do companies really MITM SSL traffic in order to watch employees surfing habits?

0942v8653 10y ago

Yes.

deleted 10y ago

[deleted]

archinal 10y ago

You bet they do! In the past I have had to manually install my company's certificates as a root CA. The annoying thing was that the certs they use are expired and use SHA-1, so I also had to explicitly tell my browser to trust expired/unsafe certificates as well. All in the name of increased security!

terminado 10y ago
I would quit a job like that, unless there were seriously profound reasons for such a grotesque invasion. 1. There are proper ways to restrict activity without resorting to eavesdropping. 2. If they don't trust you enough to be responsible and use good judgement, you're probably stuck in a dead-end situation anyway. 3. In the more rare scenarios, where you might be operating live-saving or life-threatening equipment, or handling the salaries of many people, and dealing with monentary quantities in the many millions of dollars, guess what? You probably shouldn't be using an ordinary computer, with a web browser connected to the internet to perform those sorts of tasks, within the same operating system environment as ordinary web surfing to begin with.
- dec0dedab0de 10y ago
  Some companies in highly regulated industries intercept, and inspect all traffic purely because it's easier. Though if this raised a flag, and you showed them what link you clicked, any sane IT department would laugh and start sending the link to their friends.
  - terminado 10y ago
    Other companies (tech compnies, even) engage in ridiculous behavior like timing the minutes of your bathroom breaks, and so forth. Call centers, data entry, tier one support.

recursive 10y ago

Are there really people that believe there's a possibility that they don't?

colemickens 10y ago
I'm no security expert, but I was under the impression that HSTS pinning would make that hard to do, especially on sites like google.com. And I can't quite parse your sentence to know if you're implying that all companies do... (or just that I shouldn't be so naive as to assume none are), but I can see the cert chain for google.com in my browser at ${big_company} and it doesn't seem like I'm being MITM'd.
- sillysaurus3 10y ago
  Rule of thumb: if an adversary has physical access to your computer, treat it as compromised.
  - colemickens 10y ago
    Okay? I'm very familiar with that principle, but I don't understand how to take that statement and apply it to the situation at hand. No one has ever operated this computer except me (though I did enroll the corp wifi certs). So again, how could I be MITM'd without being aware of it, given HSTS? Yes, someone could have snuck in a hacked copy of Chrome Canary that exposes phony cert chain information... but that's not what we were talking about, and I don't think most IT departments have the sophistication required to pull that off.
    - detaro 10y ago
      If you enrolled the wifi certs into your system certificate store, certificates signed by them ignore HSTS, for exactly this use case.
      - colemickens 10y ago
        I can't find any information about this. Can you point me at some additional information? Thank you in advance!

mehrdada 10y ago

I am aware of at least one lawsuit against an employee in which the firm has used a Google query an employee made as an evidence.

monknomo 10y ago

Yep, IronPort is one product, but our network guys have been saying something about it being built into the latest Cisco series 6 routers? That's the enterprise life

deleted 10y ago
[deleted]

chrisra 10y ago

Sounds like it. Our university web security lab was testing this.

lkrups 10y ago

The search term is in the url.

colemickens 10y ago
Which is still not normally visible to an outsider in an HTTPS request... (other than the cases we're discussing in the sub-thread where the company has installed a root CA and is seeing all of the traffic anyway).
sp332 10y ago
HTTPS protects everything but the domain name. If you're not using SNI it might protect the domain too.

lucb1e 10y ago

Recently did an on-site pentest at a place that does this (a municipality in the Netherlands). First thing I did was go to https://torproject.org https://torproject.org but of course that was blocked. Eventually I found a third party site that offered old versions and via an obfs proxy and bridge node I could get on the Internet uncensored (lots of sites were blocked). So yup this happens. Is it effective though? No, this took me 15 minutes and I wasn't even an employee with months if not years of time on their hands.