7 ms·

Without an SSL MITM, Intrusion Detection Systems (IDS's) are much less effective. If you're using your company's network, then they have every right to monitor

Without an SSL MITM, Intrusion Detection Systems (IDS's) are much less effective. If you're using your company's network, then they have every right to monitor all of the activity on it. They're trying to protect trade secrets, future plans, customer data, employee records, etc. from attackers who would use that information to do harm to the company, its customers, and its employees. If you don't want your employer to know what you're doing, then don't use the company computer or company network to do it. And while you may think that you're too tech savvy to fall prey to malware 1) not everyone at your company is, and 2) no amount of savvy will protect you from all malware, especially ones that gain a foothold through an unpatched exploit. And there's also that whole other can of worms: malicious employees.

ckuehl 10y ago
Totally agreed they have the right to monitor your network traffic, but I still think in most cases employees should try to push back on this. At least from my view, it's not so much that I don't want my company to know what I'm doing, as that I don't trust their software to securely MITM all of my traffic. This thread doesn't fill me with confidence about the competency of these corporate MITM proxies. And the recent Cloudflare news doesn't help either -- they're effectively the world's largest MITM proxy, and even they couldn't avoid leaking a huge amount of "secure" traffic. There are surely sectors where it's necessary for a company to MITM all traffic, but I think most companies will do better security-wise by not messing with TLS. It's just too hard to get right.
- theluketaylor 10y ago
  At my workplace where we have to do tls inspection for regulatory purposes we provide an internet-only wifi network for employee personal use where we don't intercept TLS. This network is fully isolated from the corporate network and corporate devices join a different, more monitored network. I believe this strikes the best balance between regulatory compliance and employee privacy. People can still use personal email or do online banking while at the office without inspection, but no corporate data can be moved en mass off company servers.
  - HappyTypist 10y ago
    Perfectly sensible and reasonable. Difficult to have any objections.
  - FireBeyond 10y ago
    > but no corporate data can be moved en mass off company servers. How so? 1. Connect to Corp Wifi 2. git clone companyapp.git 3. Connect to Employee Personal Wifi 4. Email tgz'ed companyapp ?
    - theluketaylor 10y ago
      When connecting a corporate device to any non-corporate network (including the employee wifi) you can't go anywhere until the vpn is connected. The vpn routes you through all the same inspection points as being on premise.
      - semi-extrinsic 10y ago
        Is both SSH and USB key / USB DVD burner usage completely disabled on your corporate devices? If not, obvious workaround is obvious.
        rocqua 10y ago
        Even a full mitm solution doesn't MitM the sneakernet.
        Intermernet 10y ago
        Ah yes, but a literal MitM solution could!
        ptaipale 10y ago
        That obvious workaround doesn't give you a 24/7 hole from the Internet. To copy information, you need a person to knowingly do it. This decreases the attack surface tremendously.
adrr 10y ago
Put it on the endpoint. You already need protection on the endpoint to protect against malware, etc and MITM solutions only cover assets on the internal network. What about company laptops?
- detaro 10y ago
  Endpoint-based MITM solutions tend to be even worse for security, since they have a larger attack surface (and generally seem to be really badly implemented). On the plus side, some things can be done locally without MITM. From a privacy perspective, it doesn't really matter if the monitoring happens centralized or not. In the cases where I've seen strict filtering laptops were forced through VPN connections to HQ, where the gateway then decides what parts of internal and external networks they are allowed to access.
- theluketaylor 10y ago
  Pretty much all the endpoint solutions MITM exactly the same way as the middle box by running as a proxy listening on localhost. They also pretty much universally do an even worse job than the network middleboxes on handling invalid certs and supporting modern tls, hard as that may be to believe. Then you have the added nightmare of ensuring a client on tens or hundreds of thousands of enpoints is fully patched and functioning correctly. Most of the solutions I have seen for devices outside the corporate perimeter are some combination of enforced vpn and authenticated proxy that is internet accessible.
rblatz 10y ago
With SSL MITM, Intrusion Detection Systems aren't even effective.
rossy 10y ago
I think this SSL MITM thing has gone way too far. When an exec asks an engineer if it's possible to monitor all internet communication that goes in and out of the company network, including communication that is encrypted by TLS, the correct answer is no. In fact, this specific thing is what TLS is designed to prevent, and new implementations of the protocol are only going to get better at preventing it. The exec will only get the answer they want if they pressure the engineer, or if the engineer is trying to sell them something (like a MITM proxy.) Then the engineer will admit that it's possible to snoop on some TLS connections if you do awful things like installing fake certificates on company laptops. They may or may not mention that if they do it wrong it will degrade the security of everything on the network. God forbid the computers at a bank should be less secure than the computers in the average household because a MITM proxy is silently downgrading the security of all the TLS connections that travel through it. Now, because engineers are so bad at saying 'no' to the people who want SSL MITM, it's apparently become a regulatory requirement. SSL MITM might let you passively surveil your employees' Facebook Messenger conversations, but it still doesn't protect you against a malicious employee who is tech-savvy (or malware written by people who have SSL MITM proxies in mind.) They could just put the information they want to smuggle out of the network into an encrypted .zip. They could even do something creative like using steganography to hide it in family photos that they upload to Facebook. The only real solution to this is to lock down the devices that people access the network on, not the network itself.
- semi-extrinsic 10y ago
  > still doesn't protect you against (...) malware written by people who have SSL MITM proxies in mind Exactly this is what I don't get. Since these abominations are becoming ubiquitous, surely malware writers are starting to work on workarounds? And in this case, it's as easy as setting up an SSH tunnel and running your malware traffic through that, which is a few days of work at best for a massive ROI?
  - marcoperaza 10y ago
    Depending on the threat model and how serious you are about locking things down, you might just block all such traffic.
zrm 10y ago
> If you're using your company's network, then they have every right to monitor all of the activity on it. It isn't a question of whether they're allowed to do it, it's a question of whether they should do it. It's ineffective against insider exfiltration of data unless you're also doing body cavity searches for USB sticks, and if you're at that point then the sensitive network should not be connected to the internet at all. And it's similarly ineffective against malware because TLS is not the only form of encryption. What difference does it make if someone uploads a file using opaque TLS vs. uploading an opaque encrypted file using MITM'd TLS? Banning encrypted files, even if you could actually detect them, doesn't work because they're often required for regulatory compliance. It isn't worth the security cost. The situation in the article is bad enough, but consider what happens if the MITM appliance itself gets compromised when it has a root private key trusted by all your devices and modify access to all the traffic.
- theluketaylor 10y ago
  >It's ineffective against insider exfiltration of data unless you're also doing body cavity searches for USB sticks, and if you're at that point then the sensitive network should not be connected to the internet at all. We opted to disable usb mass storage since cavity searches seemed a little much
  - zrm 10y ago
    > We opted to disable usb mass storage since cavity searches seemed a little much This is missing the point. Someone could plug a SATA drive directly into the motherboard, or otherwise compromise their work computer to disable the restrictions, or take pictures of documents with a camera, or bring their own computer on-site, or bring a line-of-sight wireless network device on-site, or send the data over the internet as an encrypted file or via ssh or using steganograhy and so on. The point is that preventing data exfiltration is not a trivial task, and if you're at all serious about it then the network containing the secrets is not connected to the internet. And if it's less serious than that then it can't justify a high-risk TLS MITM device.
    - deleted 10y ago
riffic 10y ago
If you're using your company's network, then they have every right to monitor all of the activity on it. This is tantamount to steaming open and resealing the envelopes of all physical mail. Have some god damn ethics, I'd sooner quit than snoop traffic in this manner.
- btbuilder 10y ago
  All MITM proxies I know require an enterprise CA trusted by the end-point. If that CA is on your machine the endpoint is probably owned by your employer. It is legal in most jurisdictions for your employer to monitor the usage of resources they have provided, be it computer or network. I would never trust a company device, or company network, with anything I consider sensitive. Use your own device and keep it on cellular. Also though I don't like it, employers in the US do have the right to open mail addressed to you personally if delivered to the office.
  - fulafel 10y ago
    This is not a US discussion though, it's about the whole web.
  - NoGravitas 10y ago
    Legal and ethical aren't the same thing, though. I agree it's legal for your employer to monitor traffic on their network. But an ethical sysadmin would not facilitate their doing so (unless there were a fairly significant and unusual justification in context). (Note: I would also never trust a company device or company network, and I keep my personal devices completely separate from the company network for this reason. But I consider this a workaround for a deplorable situation, rather than just the way things are.)
    - btbuilder 10y ago
      Personally I think that is too simplistic a position and the reality is more complex. Most people would agree that using this approach to spy on your employees to track their banking activity is unethical. Using MITM-SSL as a way to get visibility on certain APTs using products such as FireEye is controversial, but I don't personally believe to be unethical. I would argue against such an approach if there are alternatives but if the organization's leaders were set on it I would engage with the process and make sure that it did not evolve into more unethical practices such as logging all traffic contents or the above banking example.
fulafel 10y ago
Bad generalization - in many countries, it's illegal for your company to do content inspection. There's a good argument that it's unethical too. There are many ways where your company has to trust you instead of pervasively monitoring your doings and communications, and this should fall in the same area.
db48x 10y ago
I agree that this is how they see it, but it's a losing battle. There's no filter for people's minds, or for what they write down. The owner of a company cannot approach this problem from the perspective of technical bandaids; they absolutely must trust the right people, and only the right people.
phkahler 10y ago
>> If you're using your company's network, then they have every right to monitor all of the activity on it. I don't think so. Since when is it legal for anyone to circumvent encryption systems? Is it legal for your ISP to do this on "their network"? Actually, I bet you think that's OK too.
- daxelrod 10y ago
  What law in the US makes it illegal to circumvent an encryption system? I can think of the DMCA's prohibitions against circumvention measures for DRM, but that's specific to protecting copyrighted works. This FindLaw article http://employment.findlaw.com/workplace-privacy/privacy-in-the-workplace-overview.html http://employment.findlaw.com/workplace-privacy/privacy-in-t... agrees that employers have a right to monitor communications from their devices on their networks, especially when this policy has been clearly laid out and agreed to by employees. Expectation of privacy is a major deciding factor in US law. I'm not sure of the legality of an ISP doing this. I would hope it's illegal, but ISPs are weirdly regulated compared to, say, phone companies.

ckuehl 10y ago

Totally agreed they have the right to monitor your network traffic, but I still think in most cases employees should try to push back on this. At least from my view, it's not so much that I don't want my company to know what I'm doing, as that I don't trust their software to securely MITM all of my traffic. This thread doesn't fill me with confidence about the competency of these corporate MITM proxies. And the recent Cloudflare news doesn't help either -- they're effectively the world's largest MITM proxy, and even they couldn't avoid leaking a huge amount of "secure" traffic. There are surely sectors where it's necessary for a company to MITM all traffic, but I think most companies will do better security-wise by not messing with TLS. It's just too hard to get right.

theluketaylor 10y ago
At my workplace where we have to do tls inspection for regulatory purposes we provide an internet-only wifi network for employee personal use where we don't intercept TLS. This network is fully isolated from the corporate network and corporate devices join a different, more monitored network. I believe this strikes the best balance between regulatory compliance and employee privacy. People can still use personal email or do online banking while at the office without inspection, but no corporate data can be moved en mass off company servers.
- HappyTypist 10y ago
  Perfectly sensible and reasonable. Difficult to have any objections.
- FireBeyond 10y ago
  > but no corporate data can be moved en mass off company servers. How so? 1. Connect to Corp Wifi 2. git clone companyapp.git 3. Connect to Employee Personal Wifi 4. Email tgz'ed companyapp ?
  - theluketaylor 10y ago
    When connecting a corporate device to any non-corporate network (including the employee wifi) you can't go anywhere until the vpn is connected. The vpn routes you through all the same inspection points as being on premise.
    - semi-extrinsic 10y ago
      Is both SSH and USB key / USB DVD burner usage completely disabled on your corporate devices? If not, obvious workaround is obvious.
      - rocqua 10y ago
        Even a full mitm solution doesn't MitM the sneakernet.
        Intermernet 10y ago
        Ah yes, but a literal MitM solution could!
      - ptaipale 10y ago
        That obvious workaround doesn't give you a 24/7 hole from the Internet. To copy information, you need a person to knowingly do it. This decreases the attack surface tremendously.

adrr 10y ago

Put it on the endpoint. You already need protection on the endpoint to protect against malware, etc and MITM solutions only cover assets on the internal network. What about company laptops?

detaro 10y ago
Endpoint-based MITM solutions tend to be even worse for security, since they have a larger attack surface (and generally seem to be really badly implemented). On the plus side, some things can be done locally without MITM. From a privacy perspective, it doesn't really matter if the monitoring happens centralized or not. In the cases where I've seen strict filtering laptops were forced through VPN connections to HQ, where the gateway then decides what parts of internal and external networks they are allowed to access.
theluketaylor 10y ago
Pretty much all the endpoint solutions MITM exactly the same way as the middle box by running as a proxy listening on localhost. They also pretty much universally do an even worse job than the network middleboxes on handling invalid certs and supporting modern tls, hard as that may be to believe. Then you have the added nightmare of ensuring a client on tens or hundreds of thousands of enpoints is fully patched and functioning correctly. Most of the solutions I have seen for devices outside the corporate perimeter are some combination of enforced vpn and authenticated proxy that is internet accessible.

rblatz 10y ago

With SSL MITM, Intrusion Detection Systems aren't even effective.

rossy 10y ago

I think this SSL MITM thing has gone way too far. When an exec asks an engineer if it's possible to monitor all internet communication that goes in and out of the company network, including communication that is encrypted by TLS, the correct answer is no. In fact, this specific thing is what TLS is designed to prevent, and new implementations of the protocol are only going to get better at preventing it. The exec will only get the answer they want if they pressure the engineer, or if the engineer is trying to sell them something (like a MITM proxy.) Then the engineer will admit that it's possible to snoop on some TLS connections if you do awful things like installing fake certificates on company laptops. They may or may not mention that if they do it wrong it will degrade the security of everything on the network. God forbid the computers at a bank should be less secure than the computers in the average household because a MITM proxy is silently downgrading the security of all the TLS connections that travel through it. Now, because engineers are so bad at saying 'no' to the people who want SSL MITM, it's apparently become a regulatory requirement. SSL MITM might let you passively surveil your employees' Facebook Messenger conversations, but it still doesn't protect you against a malicious employee who is tech-savvy (or malware written by people who have SSL MITM proxies in mind.) They could just put the information they want to smuggle out of the network into an encrypted .zip. They could even do something creative like using steganography to hide it in family photos that they upload to Facebook. The only real solution to this is to lock down the devices that people access the network on, not the network itself.

semi-extrinsic 10y ago
> still doesn't protect you against (...) malware written by people who have SSL MITM proxies in mind Exactly this is what I don't get. Since these abominations are becoming ubiquitous, surely malware writers are starting to work on workarounds? And in this case, it's as easy as setting up an SSH tunnel and running your malware traffic through that, which is a few days of work at best for a massive ROI?
- marcoperaza 10y ago
  Depending on the threat model and how serious you are about locking things down, you might just block all such traffic.

zrm 10y ago

> If you're using your company's network, then they have every right to monitor all of the activity on it. It isn't a question of whether they're allowed to do it, it's a question of whether they should do it. It's ineffective against insider exfiltration of data unless you're also doing body cavity searches for USB sticks, and if you're at that point then the sensitive network should not be connected to the internet at all. And it's similarly ineffective against malware because TLS is not the only form of encryption. What difference does it make if someone uploads a file using opaque TLS vs. uploading an opaque encrypted file using MITM'd TLS? Banning encrypted files, even if you could actually detect them, doesn't work because they're often required for regulatory compliance. It isn't worth the security cost. The situation in the article is bad enough, but consider what happens if the MITM appliance itself gets compromised when it has a root private key trusted by all your devices and modify access to all the traffic.

theluketaylor 10y ago
>It's ineffective against insider exfiltration of data unless you're also doing body cavity searches for USB sticks, and if you're at that point then the sensitive network should not be connected to the internet at all. We opted to disable usb mass storage since cavity searches seemed a little much
- zrm 10y ago
  > We opted to disable usb mass storage since cavity searches seemed a little much This is missing the point. Someone could plug a SATA drive directly into the motherboard, or otherwise compromise their work computer to disable the restrictions, or take pictures of documents with a camera, or bring their own computer on-site, or bring a line-of-sight wireless network device on-site, or send the data over the internet as an encrypted file or via ssh or using steganograhy and so on. The point is that preventing data exfiltration is not a trivial task, and if you're at all serious about it then the network containing the secrets is not connected to the internet. And if it's less serious than that then it can't justify a high-risk TLS MITM device.
  - deleted 10y ago

riffic 10y ago

If you're using your company's network, then they have every right to monitor all of the activity on it. This is tantamount to steaming open and resealing the envelopes of all physical mail. Have some god damn ethics, I'd sooner quit than snoop traffic in this manner.

btbuilder 10y ago
All MITM proxies I know require an enterprise CA trusted by the end-point. If that CA is on your machine the endpoint is probably owned by your employer. It is legal in most jurisdictions for your employer to monitor the usage of resources they have provided, be it computer or network. I would never trust a company device, or company network, with anything I consider sensitive. Use your own device and keep it on cellular. Also though I don't like it, employers in the US do have the right to open mail addressed to you personally if delivered to the office.
- fulafel 10y ago
  This is not a US discussion though, it's about the whole web.
- NoGravitas 10y ago
  Legal and ethical aren't the same thing, though. I agree it's legal for your employer to monitor traffic on their network. But an ethical sysadmin would not facilitate their doing so (unless there were a fairly significant and unusual justification in context). (Note: I would also never trust a company device or company network, and I keep my personal devices completely separate from the company network for this reason. But I consider this a workaround for a deplorable situation, rather than just the way things are.)
  - btbuilder 10y ago
    Personally I think that is too simplistic a position and the reality is more complex. Most people would agree that using this approach to spy on your employees to track their banking activity is unethical. Using MITM-SSL as a way to get visibility on certain APTs using products such as FireEye is controversial, but I don't personally believe to be unethical. I would argue against such an approach if there are alternatives but if the organization's leaders were set on it I would engage with the process and make sure that it did not evolve into more unethical practices such as logging all traffic contents or the above banking example.

fulafel 10y ago

Bad generalization - in many countries, it's illegal for your company to do content inspection. There's a good argument that it's unethical too. There are many ways where your company has to trust you instead of pervasively monitoring your doings and communications, and this should fall in the same area.

db48x 10y ago

I agree that this is how they see it, but it's a losing battle. There's no filter for people's minds, or for what they write down. The owner of a company cannot approach this problem from the perspective of technical bandaids; they absolutely must trust the right people, and only the right people.

phkahler 10y ago

>> If you're using your company's network, then they have every right to monitor all of the activity on it. I don't think so. Since when is it legal for anyone to circumvent encryption systems? Is it legal for your ISP to do this on "their network"? Actually, I bet you think that's OK too.

daxelrod 10y ago
What law in the US makes it illegal to circumvent an encryption system? I can think of the DMCA's prohibitions against circumvention measures for DRM, but that's specific to protecting copyrighted works. This FindLaw article http://employment.findlaw.com/workplace-privacy/privacy-in-the-workplace-overview.html http://employment.findlaw.com/workplace-privacy/privacy-in-t... agrees that employers have a right to monitor communications from their devices on their networks, especially when this policy has been clearly laid out and agreed to by employees. Expectation of privacy is a major deciding factor in US law. I'm not sure of the legality of an ISP doing this. I would hope it's illegal, but ISPs are weirdly regulated compared to, say, phone companies.