3 ms·
> Unfortunately for us, all the communications with the servers in question happened over HTTPS, so we could not recover any additional details from the traffic
by LoganDark 3y ago
> Unfortunately for us, all the communications with the servers in question happened over HTTPS, so we could not recover any additional details from the traffic.
This is why your corporate network should MitM all TLS connections by default.
- computerfriend 3y agoThen you have other problems.
- sllabres 3y agoA bit further down in the same article: "Unfortunately, this method did not allow us to intercept HTTPS traffic of Apple services (including iMessage), as iOS implements SSL pinning for this"
- saagarjha 3y ago(This is sarcasm, right?)
- LoganDark 3y agoOnly partially. As an employee I would resign from a company that insisted on MitM'ing my connections. But from the position of the article, it clearly would have been valuable to have request captures from the start rather than having to try to reproduce the malware a second time.
- gdprrrr 3y agoThe risk of getting your MitM box compromised is too high IMO
- LoganDark 3y agoIs this risk analysis real? I don't believe in companies that think this is a risk at all if their box is implemented properly. If it's even possible to compromise then you have bigger problems (like your intranet not being properly secured, or the MitM setup not being sandboxed properly, or .....)