4 ms·
South Korea NIS admits to "packet tapping" Gmail
- pnathan 15y agoTapping is a mistranslation of "sniffing". (At least according to Reddit's discussion on this event).
- fraserharris 15y agoLink?
- corin_ 15y agoI don't really see why it needs any discussion as a citation, it's fairly obvious that "tapping", as in "phone tapping", means listening in to, aka sniffing when talking packets.
- mtogo 15y agoHe's not asking for a citation; grandparent said there was another discussion on the subject so parent (and I) wanted to read that discussion.
- wx77 15y agoDiscussion: http://www.reddit.com/r/netsec/comments/kj25j/south_korea_admits_to_packet_tapping_gmail/ http://www.reddit.com/r/netsec/comments/kj25j/south_korea_ad... Specific comment: http://www.reddit.com/r/netsec/comments/kj25j/south_korea_admits_to_packet_tapping_gmail/c2knx71 http://www.reddit.com/r/netsec/comments/kj25j/south_korea_ad... To corin_ : perhaps he wanted a link to see the discussion rather than a source.
- fraserharris 15y agoThis was what I was interested in.
- deleted 15y ago[deleted]
- hannibalhorn 15y agoOne would assume they forced a CA to sign a false google.com certificate and substituted that for the real one, MitM style, in order to do the decryption. Governments are obviously capable of this. Firefox's Cert Patrol or Chrome's certificate pinning are really the best defenses against this kind of thing. If you're on Chrome 13 or later, you're mostly guaranteed that gmail.com is the real deal.
- tptacek 15y agoSouth Korea does not "possess the technology to decrypt the packets transmitted over Internet lines after intercepting them", no matter what this credulous article says. The list of things law enforcement can do to capture GMail messages without secretly having compromised the most important encrypted protocol in the world includes: * Having owned up the target's box and installed malware * Having owned up the target's box and installed a bogus certificate * Redirecting the target to a bogus GMail and assuming the target doesn't care about cert warnings * Posing as a man in the middle and assuming the target doesn't care about cert warnings and on and on. Is it outside the realm of possibility that a nation state actor might have figured out a flaw in the SSL/TLS protocol that would allow them to decrypt traffic? No. Is it outside the realm of possibility that such an actor could have a bogus root certificate, or a bogus Google certificate? No. Is it outside the realm of possibility that an actor possessing one of those things would then proceed to use that capability in the course of mundane law enforcement activity, on the record, exposed to public court proceedings? Yes. It is unpossible that that happened.
- brador 15y agoHow can you be so sure that SK does not possess the technology required?
- psykotic 15y agoEven if they did have it, they wouldn't risk tipping their hand by using it in mundane law enforcement, so we can rule that out.
- brador 15y agoYou'd be surprised. Also, mistakes happen and a clueless might have signed off on it.
- pjscott 15y agoIn that spirit, which is more likely: that South Korea has figured out how to decrypt arbitrary TLS connections, or that a clueless reporter was clueless? The article also claims that Google uses deep packet inspection to do its targeted advertising. This does not inspire confidence in its accuracy.
- breck 15y agoOdds that NIS is actually decoding SSL packets: 00.1% Odds that this was before Gmail instituted HTTPS or that there is some other explanation that the reporter missed: 99.9% However, importance if the former is the case: World changing news. But extremely unlikely.
- lukeschlather 15y agoSeems to me pretty clear that SSL is kind of a joke as far as security goes, a little like WEP wireless security. Yes, unlike WEP if everything is working properly SSL is in theory safe. But there are so many gotchas, from the byzantine CA system to the fact that most of the time when a browser warns you that a certificate is bad there's nothing wrong, SSL just doesn't hold up to a determined attacker (especially a government.)
- jmillikin 15y agoWEP is completely broken. Even if you do everything right, it's trivial for an attacker to access a WEP-protected network. most of the time when a browser warns you that a certificate is bad there's nothing wrong I've never had a false-positive browser warning. I assume you're complaining about Firefox's and Chrome's treatment of self-signed certificates, which is completely appropriate. Self-signed certificates should always be rejected, unless the user has manually added them to the keystore.
- deleted 15y ago[deleted]
- foobarbazetc 15y agoEvery country in the world is "packet tapping" (whatever this means) Gmail.
- Tsagadai 15y agoThis is probably an old pre-default HTTPS Gmail, man in the middle attack and the original article is badly written as others have posted. However, the man in the middle based packet inspection and injection is widely used. From what I can tell this is how the censorship banner (http://en.wikipedia.org/wiki/File:KCSC-Warning.png http://en.wikipedia.org/wiki/File:KCSC-Warning.png) gets pasted over JS and html partials within sites the government takes issue to. Packet inspection is almost certainly being widely used.