4 ms·
ISPs in the UK mitm TLS connections and use SNI sniffing in order to block banned sites. You can see this is happening by either visiting a banned site and seei
by benmmurphy 4y ago
ISPs in the UK mitm TLS connections and use SNI sniffing in order to block banned sites. You can see this is happening by either visiting a banned site and seeing the connection being reset after the client hello is sent or you can check the TCP SYN packet your client sends on 443 vs the TCP packet the server receives. Oddly enough on the O2 network they are not simply sniffing the packets on the wire but doing a full TCP proxy because the TCP syn packet has been heavily rewritten. For example when using an iPhone the order of the SYN flags is very different from Linux. the SYN packet the server receives will look like it came from Linux even though it originated from an iPhone. This is not what you would expect if they were just doing normal NAT.
- kaszanka 4y agoWhat do you mean by the order of the SYN flags?
- benmmurphy 4y agoI meant the order of the TCP options.
- sidewndr46 4y agoFor IPv4 the SYN flag is a single bit in the packet at a fixed location. So to say the 'order' is 'very different' does not make any sense.
- benmmurphy 4y agoI misdescribed how you can detect the OS from the TCP packet with the SYN flag set. The order of the TCP options is often different between different OSs.
- jonas-w 4y agoWouldn't you need to trust their certificate?
- 10000truths 4y agoYou don't need the certificate to drop connections, it only comes into play if you're trying to impersonate an endpoint.
- MaxBarraclough 4y agobenmmurphy specifically said mitm. jonas-w is correct that this cannot be done as it would require a root certificate.
- benmmurphy 4y agoI said MITM reading the client hello and using SNI sniffing. They are fully rewriting TCP flow not just what NAT does when they adjust the address and ports on the packets. I'm not exactly sure the reason for this. It could just be a technical choice they made. But it does make it easier to flip a switch to do a full MITM that includes decryption using root certificates or using protocol attacks to decrypt traffic.
- MaxBarraclough 4y ago> ISPs in the UK mitm TLS connections They do not. As jonas-w points out, they would need a root certificate, which they don't have. Much of the value of TLS is protection against untrustworthy ISPs.