3 ms·
What if the attacker can inject a string that causes a rule match and enables "probable cause" decryption? Also, MITM attacks against vanilla TLS can be detect
by Canada 10y ago
What if the attacker can inject a string that causes a rule match and enables "probable cause" decryption?
Also, MITM attacks against vanilla TLS can be detected by endpoints. That doesn't seem be to the case here, so it makes the trusted third party problem even worse.
I'd reject anything based on this concept.
- cmdrfred 10y agoAlso, lets say it detects a 'malicious string' what happens then? Can you force a new handshake with your root CA now as the signer in the middle of a request? I'm not positive but I don't think you can without having the root certificate to begin with. Then what do you do? Just allow the connection to timeout? Sounds pretty bad from a usability perspective. > Some existing systems mount a man-in-the-middle attack on SSL by installing fake certificates at the middle- box. This enables the middlebox to break the security of SSL and decrypt the traffic so it can run DPI. This breaks the end-to-end security of SSL, and results in a host of issues, as surveyed by Jarmoc.[0] That slidedeck they cite also notes a number of issues with middleboxes that are unrelated to decrypting the traffic. If the middlebox does not have a fully updated cypher suite then it can essentially do a downgrade attack on all of it's clients. Many of these middle boxes in the past have been found to do boneheaded things like accept self signed certificates as well. A mess all around. I say sandbox the browser and be done with it. [0]https://media.blackhat.com/bh-eu-12/Jarmoc/bh-eu-12-Jarmoc-SSL_TLS_Interception-Slides.pdf https://media.blackhat.com/bh-eu-12/Jarmoc/bh-eu-12-Jarmoc-S...