9 ms·

FTA: "Using a combination of proxies, modified DNS records, sslsplit and a new CA certificate installed in Windows, we were able to inspect all traffic, includi

FTA: "Using a combination of proxies, modified DNS records, sslsplit and a new CA certificate installed in Windows, we were able to inspect all traffic, including HTTP and XMPP, in our test environment." I have setup wireshark for troubleshooting. That's about it. What's the role of proxies, modified DNS records etc. in this setup? How can I duplicate this? Thanks.

xnyhps 5y ago
The HTTP and XMPP traffic is encrypted using TLS. The proxies were used to decrypt, log and re-encrypt this traffic in real-time.
- jraph 5y ago
  And the new certificate and DNS records are to make the proxy look legit to the Zoom client, which would otherwise not accept TLS connections. Especially if there are DNS records which specify which CA is used for the certificate.
  - tialaramex 5y ago
    > Especially if there are DNS records which specify which CA is used for the certificate. If you're thinking of CAA, those records are not for anybody except the CAs. They're an indication to the CA "You may/ may not issue for these names" and explicitly never an instruction to clients about what's trustworthy. It's unusual but completely sound to have CAA set to forbid all CAs, switch it to allow just one CA, get a certificate issued, then put it back to blocking them all again for a week or months. I'm not recommending that procedure, but it's sound and if any software can't handle that the software is broken. The idea here is that all the public CAs are trustworthy but their procedures may not be a good match to your particular way of doing things. For example if a CA does ACME http-01 proof-of-control (like Let's Encrypt) and you let customers run arbitrary stuff on port 80 on your machines that's a bad combination, probably you should get your certificates from a CA which doesn't use ACME http-01 and restrict CAA.
    - jraph 5y ago
      Indeed, my mistake. Then I don't understand why they need to modify dns records.
deleted 5y ago
[deleted]
e12e 5y ago
In addition to what others have mentioned - you could probably find the session keys in ram - but for a system without debug knobs, injecting your own certificate authority is probably easier. For stuff using nss(Firefox)/openssl/gnutls - you can usually just ask nicely for a copy: > The key log file is a text file generated by applications such as Firefox, Chrome and curl when the SSLKEYLOGFILE environment variable is set. To be precise, their underlying library (NSS, OpenSSL or boringssl) writes the required per-session secrets to a file. This file can subsequently be configured in Wireshark https://wiki.wireshark.org/TLS#TLS_Decryption https://wiki.wireshark.org/TLS#TLS_Decryption https://gnutls.org/manual/html_node/Debugging-and-auditing.html https://gnutls.org/manual/html_node/Debugging-and-auditing.h...
1vuio0pswjnm7 5y ago
With DNS one can avoid having to use the firewall for redirection sslsplit documentation actually suggests DNS as an alternative to using firewall Theres a number of easy-to-use UNIX firewalls. Not sure about Windows Proxies allow easy inspection of HTTP traffic, among other things. Arguably sslsplit is itself a proxy, specifically a forward proxy There are many ways to monitor HTTP traffic. More than one way to do it Why doesnt Zoom use certificate pinning (I avoid using sites/apps that force use of third-party controlled pinned certificates. What are they trying to hide from the user)
- Wowfunhappy 5y ago
  Certificate pinning makes it impossible to examine what the software on my own machine is sending over my network! Please don't do that.
  - fn-mote 5y ago
    Isn't certificate pinning what keeps my employer from MITM'ing my personal email session on their network?
    - EvanAnderson 5y ago
      No. Your employer can't MITM your personal email session if you don't trust their MITM proxy's CA.
      - notatoad 5y ago
        if your employer controls your work computer, they can set it to trust their MITM CA. cert pinning means they can't do that unless they're also modifying yoru email client binaries.
        Thorrez 5y ago
        It depends on your email client. If your email client is Chrome, then the pinning won't help you at all. >Chrome does not perform pin validation when the certificate chain chains up to a private trust anchor. https://chromium.googlesource.com/chromium/src/+/refs/heads/main/docs/security/faq.md#how-does-key-pinning-interact-with-local-proxies-and-filters https://chromium.googlesource.com/chromium/src/+/refs/heads/...
TobTobXX 5y ago
Not entirely sure if this I'm understanding this correctly (since it doesn't really make sense to me), but this is what they wrote almost at the end: > Anything we did differently could influence the heap layout. For example, we noticed that adding network interception could have some effect on how network requests were allocated, changing the heap layout.

xnyhps 5y ago

The HTTP and XMPP traffic is encrypted using TLS. The proxies were used to decrypt, log and re-encrypt this traffic in real-time.

jraph 5y ago
And the new certificate and DNS records are to make the proxy look legit to the Zoom client, which would otherwise not accept TLS connections. Especially if there are DNS records which specify which CA is used for the certificate.
- tialaramex 5y ago
  > Especially if there are DNS records which specify which CA is used for the certificate. If you're thinking of CAA, those records are not for anybody except the CAs. They're an indication to the CA "You may/ may not issue for these names" and explicitly never an instruction to clients about what's trustworthy. It's unusual but completely sound to have CAA set to forbid all CAs, switch it to allow just one CA, get a certificate issued, then put it back to blocking them all again for a week or months. I'm not recommending that procedure, but it's sound and if any software can't handle that the software is broken. The idea here is that all the public CAs are trustworthy but their procedures may not be a good match to your particular way of doing things. For example if a CA does ACME http-01 proof-of-control (like Let's Encrypt) and you let customers run arbitrary stuff on port 80 on your machines that's a bad combination, probably you should get your certificates from a CA which doesn't use ACME http-01 and restrict CAA.
  - jraph 5y ago
    Indeed, my mistake. Then I don't understand why they need to modify dns records.

deleted 5y ago

[deleted]

e12e 5y ago

In addition to what others have mentioned - you could probably find the session keys in ram - but for a system without debug knobs, injecting your own certificate authority is probably easier. For stuff using nss(Firefox)/openssl/gnutls - you can usually just ask nicely for a copy: > The key log file is a text file generated by applications such as Firefox, Chrome and curl when the SSLKEYLOGFILE environment variable is set. To be precise, their underlying library (NSS, OpenSSL or boringssl) writes the required per-session secrets to a file. This file can subsequently be configured in Wireshark https://wiki.wireshark.org/TLS#TLS_Decryption https://wiki.wireshark.org/TLS#TLS_Decryption https://gnutls.org/manual/html_node/Debugging-and-auditing.html https://gnutls.org/manual/html_node/Debugging-and-auditing.h...

1vuio0pswjnm7 5y ago

With DNS one can avoid having to use the firewall for redirection sslsplit documentation actually suggests DNS as an alternative to using firewall Theres a number of easy-to-use UNIX firewalls. Not sure about Windows Proxies allow easy inspection of HTTP traffic, among other things. Arguably sslsplit is itself a proxy, specifically a forward proxy There are many ways to monitor HTTP traffic. More than one way to do it Why doesnt Zoom use certificate pinning (I avoid using sites/apps that force use of third-party controlled pinned certificates. What are they trying to hide from the user)

Wowfunhappy 5y ago
Certificate pinning makes it impossible to examine what the software on my own machine is sending over my network! Please don't do that.
- fn-mote 5y ago
  Isn't certificate pinning what keeps my employer from MITM'ing my personal email session on their network?
  - EvanAnderson 5y ago
    No. Your employer can't MITM your personal email session if you don't trust their MITM proxy's CA.
    - notatoad 5y ago
      if your employer controls your work computer, they can set it to trust their MITM CA. cert pinning means they can't do that unless they're also modifying yoru email client binaries.
      - Thorrez 5y ago
        It depends on your email client. If your email client is Chrome, then the pinning won't help you at all. >Chrome does not perform pin validation when the certificate chain chains up to a private trust anchor. https://chromium.googlesource.com/chromium/src/+/refs/heads/main/docs/security/faq.md#how-does-key-pinning-interact-with-local-proxies-and-filters https://chromium.googlesource.com/chromium/src/+/refs/heads/...

TobTobXX 5y ago

Not entirely sure if this I'm understanding this correctly (since it doesn't really make sense to me), but this is what they wrote almost at the end: > Anything we did differently could influence the heap layout. For example, we noticed that adding network interception could have some effect on how network requests were allocated, changing the heap layout.