6 ms·

There's a terrible enterprise security product that can be configured by IT to quasi-MITM your company web traffic. Instead of relying on enterprises pushing th

There's a terrible enterprise security product that can be configured by IT to quasi-MITM your company web traffic. Instead of relying on enterprises pushing their own trusted root certs and MITMing the whole session this terrible product redirects all traffic to (and I'm not kidding here) urls like "www.terriblesecuritycompanyname.com/www.originalurl.com" when the user accesses www.originalurl.com. So this "enterprise security" company encourages end users to put information such as passwords into www.terriblesecuritycompanyname.com/owa.office365.com for example. Of course everyone has SSO enabled for Office 365 but everyone is also used to SSO sometimes breaking and falling back to forms based auth so people have no issue typing their passwords into any page that looks somewhat legit as long as the URL is close to what they expect and has a little lock next to it. Anyway www.turriblesecuritycompanyname.com is available and I'm waiting for someone nefarious to purchase it and start sending phishing emails with links to www.turriblesecuritycompany.com/owa.office365.com embedded in them.

jonahx 6y ago
> redirects all traffic to (and I'm not kidding here) urls like "www.terriblesecuritycompanyname.com/www.originalurl.com" when the user accesses www.originalurl.com. What is the theoretical security feature they are selling by doing this?
- snazz 6y ago
  The ability to block malware and phishing domains, insight to IT people about what sites are being visited, content filtering, etc. While most of this should be implemented in another way (like maybe a mandatory browser extension?), MITM is still the standard approach for many companies.
ganstyles 6y ago
It depends on which ethical framework you subscribe to, but if I were in your shoes using my ethical framework, it seems like the small cost to me to purchasing an available domain (making the assumption here it's a standard buy and it's not one of those "make an offer for $10k" domains...) to mitigate a lot of potential hurt to other people would make me lean toward just purchasing the domain myself, or at least making the correct people aware. An equally valid counterexample would be a framework where you didn't cause the harm, so you have no obligation to intervene.
- jjeaff 6y ago
  Your ethical framework in this case could clash with the arguably broken legal framework that we currently live in. Buying a domain like that could get you into legal trouble once it is found out and people track sensitive traffic funneling to the domain. Even if you aren't doing anything with the information.
  - dopylitty 6y ago
    This, exactly. One thing I've learned about "infosec" companies is that their litigiousness is inversely proportional to their actual level of security. The similar domains I've seen are only $9 though so it's just a matter of time.
quicklime 6y ago
Wow, that sounds awful. Do you know what they did (assuming not nothing) to have browsers continue to enforce the same-origin policy, and block www.terriblesecuritycompanyname.com/evilhacker.com from accessing cookies that belong to www.terriblesecuritycompanyname.com/owa.office365.com?
- dopylitty 6y ago
  I haven't looked into it that deeply to see how (whether) they're handling same origin or cookie access. I assume they're doing some kind of magic other than just rewriting the URLs. If you haven't been involved with enterprise information security you'd be surprised by how intrusive and poorly conceived these services are in a lot of cases. Tavis Ormandy and others have famously found many AV products to be running un-sandboxed untrusted javascript in kernel mode. In line web proxies have been found to do things like sign untrusted or revoked certs with a trusted root cert. It's all pretty much a big grift to capitalize on companies' rightful cyber security fears.

jonahx 6y ago

> redirects all traffic to (and I'm not kidding here) urls like "www.terriblesecuritycompanyname.com/www.originalurl.com" when the user accesses www.originalurl.com. What is the theoretical security feature they are selling by doing this?

snazz 6y ago
The ability to block malware and phishing domains, insight to IT people about what sites are being visited, content filtering, etc. While most of this should be implemented in another way (like maybe a mandatory browser extension?), MITM is still the standard approach for many companies.

ganstyles 6y ago

It depends on which ethical framework you subscribe to, but if I were in your shoes using my ethical framework, it seems like the small cost to me to purchasing an available domain (making the assumption here it's a standard buy and it's not one of those "make an offer for $10k" domains...) to mitigate a lot of potential hurt to other people would make me lean toward just purchasing the domain myself, or at least making the correct people aware. An equally valid counterexample would be a framework where you didn't cause the harm, so you have no obligation to intervene.

jjeaff 6y ago
Your ethical framework in this case could clash with the arguably broken legal framework that we currently live in. Buying a domain like that could get you into legal trouble once it is found out and people track sensitive traffic funneling to the domain. Even if you aren't doing anything with the information.
- dopylitty 6y ago
  This, exactly. One thing I've learned about "infosec" companies is that their litigiousness is inversely proportional to their actual level of security. The similar domains I've seen are only $9 though so it's just a matter of time.

quicklime 6y ago

Wow, that sounds awful. Do you know what they did (assuming not nothing) to have browsers continue to enforce the same-origin policy, and block www.terriblesecuritycompanyname.com/evilhacker.com from accessing cookies that belong to www.terriblesecuritycompanyname.com/owa.office365.com?

dopylitty 6y ago
I haven't looked into it that deeply to see how (whether) they're handling same origin or cookie access. I assume they're doing some kind of magic other than just rewriting the URLs. If you haven't been involved with enterprise information security you'd be surprised by how intrusive and poorly conceived these services are in a lot of cases. Tavis Ormandy and others have famously found many AV products to be running un-sandboxed untrusted javascript in kernel mode. In line web proxies have been found to do things like sign untrusted or revoked certs with a trusted root cert. It's all pretty much a big grift to capitalize on companies' rightful cyber security fears.