8 ms·
NoSnoop – Find out if your HTTPS traffic is being monitored
- ianai 7y agoAnybody able to verify this does what it says? Random windows zip download from a domain I’ve not heard of sounds pretty sketchy.
- judge2020 7y ago> NoSnoop contains no adware, malware or sponsored content of any sort. well it says this so no reason to distrust it :)
- johnday 7y agoOn the off-chance that this was said unironically, you should never trust someone just because they say you should. Especially if they aren't sharing the code.
- judge2020 7y agoIt was sarcasm but you're right and a reader might not understand the joke.
- mpfundstein 7y agoI think its pretty hard to not understand your joke.
- notelonmusk 7y agohttps://www.virustotal.com/gui/ip-address/213.186.33.17/relations https://www.virustotal.com/gui/ip-address/213.186.33.17/rela...
- ShakataGaNai 7y agohttps://www.virustotal.com/gui/file/53845538e0f518f99afe53bddb7b391c18890ada4d030c519ad961783ed57f8a/detection https://www.virustotal.com/gui/file/53845538e0f518f99afe53bd... So nothing major is detected. That doesn't necessarily mean it's safe. Just... a data point.
- BasicObject 7y agoHuawei is alerting for me. www.huawei.com 0 Actalis Authentication Root CA F373B387065A28848AF2F34ACE192BDDC78E9CAC
- c0nducktr 7y agoThat one is alerting for me as well. Same thumbprint.
- vxxzy 7y agosame on my end. same thumbprint.
- throwaway288383 7y agowww.huawei.com 0 Actalis Authentication Root CA F373B387065A28848AF2F34ACE192BDDC78E9CAC same for me is there reason why though?
- throwaway1777 7y agoWho’s your isp?
- tialaramex 7y agoSo what that means is that this software expected to see some other certificate but instead it saw this one. huawei has had a considerable number of wildcard (*.huawei.com) certificates issued for whatever reason (configuration screw-up, somebody press the button too many times, different teams with same job, this happens) and you can see a bunch of them here: https://crt.sh/?q=huawei.com https://crt.sh/?q=huawei.com The software's assumption is that (for some sites at least) the author can check what the "right" certificate is and if you see a different one that's wrong. That clearly won't work for some sites any of the time, they use a CDN to present different behaviour including certificates in different places, and presumably the author weeds those out. But as we see here it can't work for _any_ site all the time, it will be inconsistent.
- oefrha 7y ago> a considerable number of wildcard (*.huawei.com) certificates issued for whatever reason... Is there any downside to this? I mean, I have several wildcard certs issued for each of my personal domains mainly because it's more convenient to get separate certs on each host with certbot than trying to sync certs from one host to another. Is there any reason I shouldn't do this?
- mikece 7y agoIf it's a tool to verify that there's not an active MITM, how do you detect if a MITM used a forged cert in lying that nobody is in the middle? In theory the MITM would see both the outbound request and the response, putting them in position to pull off a forgery like that.
- oropolo 7y agoQ. Can I detect a MITM (machine in the middle) attack? A. No, not easily. https://security.stackexchange.com/questions/12066/can-i-detect-a-mitm-attack https://security.stackexchange.com/questions/12066/can-i-det...
- acdha 7y agoThat’s one answer of many and it’s wrong. A correct answer would discuss the various active and passive detection methods and their weaknesses, and especially how it’s easy to detect an unskilled attack but progressively harder to foil a sophisticated one. Simple examples: 1. Analysis of TCP details could detect an intermediary proxy 2. TLS conflicts tell you a bad attacker is trying; use of a certificate from a different CA or an old one tells you someone has been compromised. 3. Attempts to block or throttle TLS, downgrade protocols, or block/degrade access to security updates tells you someone is trying to encourage you to act in an insecure manner. 4. If you send unique canary hostnames or URLs which are accessed, you know something has compromised your traffic. 5. Timing analysis can tell you that some target sites are being treated differently, which could be a sign that traffic is being more tightly monitored (IIRC this has been noticed with the great firewall). 6. HTTP pages can be requested from multiple sources and compared for modifications. I once learned about some JavaScript being injected into pages on Iranian college computers when their code triggered errors this way.
- burundi_coffee 7y agoIs this FOSS?
- kuratkull 7y agoI'm sure you could whip up something like this in about 10 lines of bash.
- eurasiantiger 7y agoIs that a challenge?
- Mizza 7y agoDoes anybody remember a project called "Perspectives"? It was a Firefox plugin that would verify your certificates and handshakes were the same as the ones other users were getting. Cool idea.
- c0nducktr 7y agoYeah, it didn't really seem to take off but I had it installed for a while. The site is still up. https://perspectives-project.org https://perspectives-project.org
- kekebo 7y agoThe addon appears to be missing though https://addons.mozilla.org/en-US/firefox/addon/perspectives/ https://addons.mozilla.org/en-US/firefox/addon/perspectives/
- pabs3 7y agoThe addon cannot work any longer because since the XUL to WebExtensions transition Firefox no longer allows addons to make decisions about the validity of https certificates. This killed off Perspectives and a number of other addons implementing alternate trust models. https://bugzilla.mozilla.org/show_bug.cgi?id=1435951 https://bugzilla.mozilla.org/show_bug.cgi?id=1435951 https://bugzilla.mozilla.org/show_bug.cgi?id=1489080 https://bugzilla.mozilla.org/show_bug.cgi?id=1489080
- c0nducktr 7y agoI hope the functionality could be added back with an API. Honestly I had forgot all about that addon until Mizza mentioned it, but I remember being so impressed by the idea back when I first learned about it. I wish we could bring it back.
- pabs3 7y agoI'd suggest subscribing to the Mozilla bugs about this to get notified if that ever happens.
- amingilani 7y agoInteresting. Is there a Mac/Linux version of a tool similar to this?
- arminiusreturns 7y agoThis was my first question as well (on top of the source code question)
- akerro 7y agoMy other comment: There is also OONI for mobile from TorProject that does the same, app and data are opensource. Available in FDroid https://ooni.torproject.org/ https://ooni.torproject.org/
- gianpaj 7y ago100 MB for the Windows for Mac OONI Probe Desktop? Electron face palm
- rand0mx1 7y agoIs this program any different from goodbyedpi https://github.com/ValdikSS/GoodbyeDPI https://github.com/ValdikSS/GoodbyeDPI
- utefan001 7y agoFYI, if you google mitm check you should see a link to this site. A service provided by the caddy server devs. https://mitm.watch/ https://mitm.watch/
- alibert 7y agoOn my home network, I get the green OK page on my desktop computer on Brave but I get the red `Likely MITM` on my iPhone with latest iOS. How should I conclude?
- sschueller 7y agoVia wifi or cell?
- alibert 7y agoSame network for both: fixed ethernet on my desktop computer and wifi for the phone. I tried LTE only and I also get the red MITM page. Edit: tried my laptop on wifi, green OK
- cmg 7y agoInteresting. I tried on my home WiFi (Comcast) on my Mac - green page (no MITM). On my iPhone, (AT&T LTE) - red MITM page. iPhone on my WiFi - red MITM page even with the cellular antenna disabled(!) Tethered my laptop to my phone - red MITM page.
- tantalic 7y agoThe technique used here currently has a known issue with iOS 13: https://github.com/caddyserver/caddy/issues/2771 https://github.com/caddyserver/caddy/issues/2771
- yborg 7y agoI get the red page with Firefox Developer Edition with no extensions, Chrome and Safari are green on same machine. I have all of the anti-fingerprinting stuff turned on in FF though.
- cascom 7y agoThis is pretty low-tech but I think is pretty effective. https://www.grc.com/fingerprints.htm https://www.grc.com/fingerprints.htm
- eikenberry 7y agoI get matching results for everything but wikipedia. I doubled checked with my VPS and got the same results. Could it be using region based routing to sites with different certs or something?
- pmoriarty 7y agoSame here. From the GRC fingerprints page FAQ: "What can go wrong with this test? "There ARE several things to consider: "False-Positive Mismatches: "Smaller web sites, like this one (GRC) and those others listed above, deploy only one security certificate on one or more web servers (For example, our wonderful certificate provider, DigiCert, specifically allows us to use the same single certificate on as many servers as necessary.) "But companies with a massive and widely distributed web presence, such as Amazon or Google, may deploy many different security certificates across their many globally distributed servers and web sites. Multiple certificates may be easier for them to obtain and manage, and their security is not reduced. But it does mean that not every user of their servers (like you and this GRC page) would necessarily obtain the same security certificate. "This means that a simple comparison of certificate fingerprints could erroneously lead people wishing to test these huge websites to conclude that their connections were being intercepted, when they have simply received a different valid certificate than the one received and shown by this web page. "The best solution is to test smaller sites that are known to be using single certificates, or sites using the completely unspoofable extended validation (EV) certificates with an EV-honoring web browser such as Firefox or Chrome (but not Internet Explorer, which doesn't properly verify EV certificates)."
- jf- 7y agoWould these be expected to change by country? I’m getting different results from grc for Facebook, Wikipedia and others in the UK, but the results are consistent between different connections. Results match for grc and paypal.
- akerro 7y agoThere is also OONI for mobile from TorProject that does the same, app and data are opensource. Available in FDroid https://ooni.torproject.org/ https://ooni.torproject.org/
- CapacitorSet 7y agoI find it somewhat ironic that the tool is served over HTTPS over some random domain. Certainly if an attacker has the resources to forge a certificate for eg. telegram.org doing the same for trustprobe.com won't be much harder.
- mosselman 7y agoI think the idea is that you already have this tool before you are mitm-ed. Also, you don't really think that attackers are gods right? As in that they know about every single website that could alert their victims of their attack?
- fefe23 7y agoA tool like this should be running in a browser. Otherwise, if the method of intercepting the traffic only manipulates the browser (for example a rogue extension or proxy setting you were not aware of), a standalone tool could not detect it. Right? Also, I would generally avoid any security tools that do not come as source code. Mentioning that you are an infosec guy with 15 years of experience only makes this point hit even harder.
- cheez 7y agoIt's not possible to access certificates in the browser.
- tialaramex 7y agoAn extension can do it: https://addons.mozilla.org/en-GB/firefox/addon/certainly-something/ https://addons.mozilla.org/en-GB/firefox/addon/certainly-som...
- badrabbit 7y agoRight, banking trojans for example inject code into browser processes so the trojan can sniff decrypted traffic. Corporate snooping is also done by pushing root certs on to both system wide and browset trust stores.
- kuratkull 7y agobbc.co.uk and huawei.com gave "ALERT"s for me. Manual verification shows the cert chains to be sane. The application should give me more details about the error conditions it hit. EDIT: www.bbc.co.uk 0 GlobalSign 1F24C630CDA418EF2069FFAD4FDD5F463A1B69AA www.huawei.com 0 Actalis Authentication Root CA F373B387065A28848AF2F34ACE192BDDC78E9CAC
- wearedevo 7y agoThis bit is interesting: "This website does not collect any personal information." - after taking about the product for the entire page. Note "website", not "software".
- deleted 7y ago[deleted]
- Krasnol 7y ago> Error initiating scan - Please check your internet connection. Doesn't work here or should I be concerned? ;)
- tgsovlerkhgsel 7y agoThere is also another project that uses not just certificates but full TLS handshake fingerprints. The name escapes me, but it allows the server to determine whether it is talking to a browser, or the MitM proxy forwarding the connection. (You could of course employ a similar technique on the client side). Don't remember the name. Both approaches have advantages and disadvantages (e.g. this one reports false positives if the certificates change, the other either reports false positives if the fingerprints change unexpectedly, or false negatives/inconclusive results if it encounters an unknown fingerprint).