5 ms·

Would someone with network access in Kazakhstan check if Caddy's MITM detector catches this please? https://caddyserver.com/docs/mitm-detection https://caddyser

by mholt 7y ago

Would someone with network access in Kazakhstan check if Caddy's MITM detector catches this please? https://caddyserver.com/docs/mitm-detection https://caddyserver.com/docs/mitm-detection - or https://mitm.watch https://mitm.watch (Cloudflare's unofficial deployment of the same tech). If it does not, could you file a bug report with a complete packet capture (and exact browser version - multiple browsers are preferred)? https://github.com/caddyserver/caddy/issues https://github.com/caddyserver/caddy/issues (Edit: Reportedly, "not all Internet providers have started MITM attacks yet" so if you do the test, make sure you are on an intercepted network... if safe to do so.)

marmaduke 7y ago
Theoretical quedtion: would a VPN in Kazakhstan allow you to test this?
- trazire 7y ago
  No, as the certificates are user installed. The Bugzilla and other threads are about distrusting that user certificate.
  - filleokus 7y ago
    VPN with endpoint on affected ISP + Installing the cert (which is linked in the issue on Bugzilla) should be the same as just using the affect ISP directly, shouldn't it?
    - trazire 7y ago
      Yeah, it should, unless this is only for residential ISPs, which I strongly doubt. I can't appear to find a Kazakhstan-hosted VPN however, did you find one?
- deleted 7y ago
  [deleted]
lame-robot-hoax 7y ago
So uh, should I be concerned at all if my connection came back as a likely MITM from my home network in the US? Or is it most likely a false positive caused by my firewall or something? I tested it both off a VPN and on a VPN from my iPhone yet still had the same result both times.
- floatingatoll 7y ago
  Which ISP?
  - lame-robot-hoax 7y ago
    Cox cable but I just checked on my Fedora box and it came through as MITM unlikely so it looks like it’s just an oddity with iOS like mholt said.
- snazz 7y ago
  If your phone is also used for work, you might have gotten a root certificate installed through their MDM program. Check Settings>General>About>Certificate Trust Settings for a root certificate.
- mholt 7y ago
  iOS is tricky because of its weird rules regarding TLS libraries and web views. If you are sure you haven't any rogue CA certs in your applicable trust stores, it's probably a false positive.
  - lame-robot-hoax 7y ago
    Yeah no CA certs as this is a personal phone, and I just checked from my Fedora box and it said MITM unlikely so guessing it’s just iOS being weird.
  - tgragnato 7y ago
    FYI, Safari on iOS 13 (beta) uses a different set and ordering of extensions. I currently see "0, 23, 65281, 10, 11, 16, 5, 13, 18, 51, 45, 43, 21".
filleokus 7y ago
I just tested with ExpressVPN via their Kazakhstan endpoint. On 46.244.29.XXX on the ISP A2B IP B.V. I don't seem to be MITM'ed at all, so I can't report anything about the MITM-detector.
- mholt 7y ago
  Thanks for the report. Both I and Cloudflare[1] are interested in any updates. If you know your connection is being MITM'ed by your ISP or your government please do the test again if it is safe to do so. [1]: https://twitter.com/grittygrease/status/1151921809417048064 https://twitter.com/grittygrease/status/1151921809417048064
- envy2 7y ago
  Their Kazakhstan endpoint is fake; it's a 'virtual' exit node that's actually in Singapore. This info is buried in their help pages: https://www.expressvpn.com/support/troubleshooting/virtual-server-locations/ https://www.expressvpn.com/support/troubleshooting/virtual-s...
  - duskwuff 7y ago
    This sort of misbehavior is, unfortunately, common to a number of VPN services that claim to have endpoints in many unusual countries. ExpressVPN has sort of owned up to it (but they don't exactly make those disclosures obvious); others have not. https://restoreprivacy.com/vpn-server-locations/ https://restoreprivacy.com/vpn-server-locations/
niij 7y ago
Would this detect MITM if you installed a root cert from ex: school, employer, etc?
dalf 7y ago
For reference The code is here: https://github.com/caddyserver/caddy/blob/master/caddyhttp/httpserver/mitm.go https://github.com/caddyserver/caddy/blob/master/caddyhttp/h... The paper: https://jhalderm.com/pub/papers/interception-ndss17.pdf https://jhalderm.com/pub/papers/interception-ndss17.pdf
cascom 7y ago
Does this do something substantially different than: https://www.grc.com/fingerprints.htm https://www.grc.com/fingerprints.htm
alexeykapustin 7y ago
In Russia on attempt to open https://mitm.watch https://mitm.watch I get provider's page with message "Requested IP is blocked"

by mholt 7y ago

marmaduke 7y ago

Theoretical quedtion: would a VPN in Kazakhstan allow you to test this?

trazire 7y ago
No, as the certificates are user installed. The Bugzilla and other threads are about distrusting that user certificate.
- filleokus 7y ago
  VPN with endpoint on affected ISP + Installing the cert (which is linked in the issue on Bugzilla) should be the same as just using the affect ISP directly, shouldn't it?
  - trazire 7y ago
    Yeah, it should, unless this is only for residential ISPs, which I strongly doubt. I can't appear to find a Kazakhstan-hosted VPN however, did you find one?
deleted 7y ago
[deleted]

lame-robot-hoax 7y ago

So uh, should I be concerned at all if my connection came back as a likely MITM from my home network in the US? Or is it most likely a false positive caused by my firewall or something? I tested it both off a VPN and on a VPN from my iPhone yet still had the same result both times.

floatingatoll 7y ago
Which ISP?
- lame-robot-hoax 7y ago
  Cox cable but I just checked on my Fedora box and it came through as MITM unlikely so it looks like it’s just an oddity with iOS like mholt said.
snazz 7y ago
If your phone is also used for work, you might have gotten a root certificate installed through their MDM program. Check Settings>General>About>Certificate Trust Settings for a root certificate.
mholt 7y ago
iOS is tricky because of its weird rules regarding TLS libraries and web views. If you are sure you haven't any rogue CA certs in your applicable trust stores, it's probably a false positive.
- lame-robot-hoax 7y ago
  Yeah no CA certs as this is a personal phone, and I just checked from my Fedora box and it said MITM unlikely so guessing it’s just iOS being weird.
- tgragnato 7y ago
  FYI, Safari on iOS 13 (beta) uses a different set and ordering of extensions. I currently see "0, 23, 65281, 10, 11, 16, 5, 13, 18, 51, 45, 43, 21".

filleokus 7y ago

I just tested with ExpressVPN via their Kazakhstan endpoint. On 46.244.29.XXX on the ISP A2B IP B.V. I don't seem to be MITM'ed at all, so I can't report anything about the MITM-detector.

mholt 7y ago
Thanks for the report. Both I and Cloudflare[1] are interested in any updates. If you know your connection is being MITM'ed by your ISP or your government please do the test again if it is safe to do so. [1]: https://twitter.com/grittygrease/status/1151921809417048064 https://twitter.com/grittygrease/status/1151921809417048064
envy2 7y ago
Their Kazakhstan endpoint is fake; it's a 'virtual' exit node that's actually in Singapore. This info is buried in their help pages: https://www.expressvpn.com/support/troubleshooting/virtual-server-locations/ https://www.expressvpn.com/support/troubleshooting/virtual-s...
- duskwuff 7y ago
  This sort of misbehavior is, unfortunately, common to a number of VPN services that claim to have endpoints in many unusual countries. ExpressVPN has sort of owned up to it (but they don't exactly make those disclosures obvious); others have not. https://restoreprivacy.com/vpn-server-locations/ https://restoreprivacy.com/vpn-server-locations/

niij 7y ago

Would this detect MITM if you installed a root cert from ex: school, employer, etc?

dalf 7y ago

For reference The code is here: https://github.com/caddyserver/caddy/blob/master/caddyhttp/httpserver/mitm.go https://github.com/caddyserver/caddy/blob/master/caddyhttp/h... The paper: https://jhalderm.com/pub/papers/interception-ndss17.pdf https://jhalderm.com/pub/papers/interception-ndss17.pdf

cascom 7y ago

Does this do something substantially different than: https://www.grc.com/fingerprints.htm https://www.grc.com/fingerprints.htm

alexeykapustin 7y ago

In Russia on attempt to open https://mitm.watch https://mitm.watch I get provider's page with message "Requested IP is blocked"