3 ms·

I'd say this is likely bullshit at least that it was done against a Brazilian company. Why take the risk of getting caught and burning your ability to do this

I'd say this is likely bullshit at least that it was done against a Brazilian company. Why take the risk of getting caught and burning your ability to do this when you can get the information from Google? 1) Chrome(and some plugins) pin's certificates and would notice a man in the middle attack(unless it was done with google's key). Sure, most corporate targets probably use IE, but if anyone uses chrome on or one of these plugins on the network, you've both alerted your target and exposed a presumably tightly guarded ability. Hell, if it get's reported, you've probably burned the ability. Of course, you might be able to filter out both the plugins and chrome, but it's a risk. 2) NSA could legitimately just ask for the company's emails from Google. Petrobras is a Brazilian company in Brazil staffed by Brazilians and as such a legally allowed target for Foreign Surveillance without either the NSA's twisted definitions of search and who is a US national. Google is legally required to hand over the information by the Foreign Intelligence Surveillance Amendment Act of 2008. Why authorize an operation that could reveal both the CA's you have in your pocket and you network penetration exploits? As a side note, the cited slide looks nothing like anything else we have seen and lack security/ handling information (e.g the prominent TS/SCI/ORCON/NOFORN on the top of the prism slides).

raverbashing 13y ago
There is no implied relation in the presentation between MITM attacks and the attack on Petrobras They're merely on the same presentation describing attacks and targets
jlgaddis 13y ago
I believe Chrome only "pins" certain certificates and almost certainly doesn't pin every SSL certificate you may happen to come across -- this is what the EFF's Observatory[0] and browser plugins like Certificate Patrol[1] are for -- although I may very well be wrong on that. Also, a March 2010 research paper by Christopher Soghoian and Sid Stamm "in which they present evidence that certificate authorities (CAs) may be cooperating with government agencies to help them spy undetected on 'secure' encrypted communications."[2] More details on that from the EFF[3] but if we assume that the government can obtain Google's private keys then they could almost certainly carry this out undetected, IMO. [0]: https://www.eff.org/observatory https://www.eff.org/observatory [1]: https://addons.mozilla.org/en-US/firefox/addon/certificate-patrol/ https://addons.mozilla.org/en-US/firefox/addon/certificate-p... [2]: http://files.cloudprivacy.net/ssl-mitm.pdf http://files.cloudprivacy.net/ssl-mitm.pdf [3]: https://www.eff.org/deeplinks/2010/03/researchers-reveal-likelihood-governments-fake-ssl https://www.eff.org/deeplinks/2010/03/researchers-reveal-lik...
- anologwintermut 13y ago
  I think it pin's google's certificates. The article claims The goal of the attack was to "impersonate Google security certificates." I'm not saying NSA doesn't have the ability, just the implication that it was used against Brazil is likely wrong.
  - jlgaddis 13y ago
    > I think it pin's google's certificates. That's what I understand as well but I don't think they pin much more than that -- and certainly not every SSL certificate on every site one might connect to.
    - deleted 13y ago
      [deleted]
einaros 13y ago
Where did you read that it's mail traffic they were after? I'm beginning to strongly believe that it's Google's other services are considered for use in specific attacks. Imagine if some foreign service, that is outside of an NSL's reach, has communication that the NSA wants to snoop on. If they can't break the crypto, but that service happens to load jQuery off of Google's CDN, or use Google Analytics, the NSA could pull a MITM attack and manipulate the content of the requested scripts. Those scripts could rather easily act as proxies for the NSA or others, and either hijack sessions or pull data straight out of the protected services. I'm tooting my own horn here, but that's exactly the kind of thing this blog post speculates on: https://2x.io/read/would-the-nsa-infiltrate-cdns-to-circumvent-https https://2x.io/read/would-the-nsa-infiltrate-cdns-to-circumve...
taway2012 13y ago
AFAIK, Chrome "certificate pinning" may not exactly be what you think "certificate pinning" means. It should be more precisely called "certificate authority pinning". What it means is that Chrome will not trust certs for Google properties except those issued by certain certificate authorities. Reference: https://www.imperialviolet.org/2011/05/04/pinning.html https://www.imperialviolet.org/2011/05/04/pinning.html Unless things changed since I last checked. In contrast, "real" "certificate pinning" as done in some mobile apps (IIRC Twitter) involves storing the hash of the certificate itself in the app. No other certificate, even from the same CA, will be accepted.
- anologwintermut 13y ago
  You are correct chrome pins the authority, not the cert. And at least as for 2011, they don't just pin their own sub authority, they include a couple of real authorities who's keys the NSA might have. https://www.imperialviolet.org/2011/05/04/pinning.html https://www.imperialviolet.org/2011/05/04/pinning.html
deleted 13y ago
[deleted]
nl 13y ago
Technically FISA only allows surveillance of foreign nationals or powers in association with a terrorist investigation[1]. No idea how closely this is enforced. HOWEVER, there is plenty of other legislation enabling the NSA to spy on non-US parties in different circumstances. [1] http://en.wikipedia.org/wiki/Foreign_Intelligence_Surveillance_Act#Scope_and_limits http://en.wikipedia.org/wiki/Foreign_Intelligence_Surveillan...
nl 13y ago
Technically FISA only allows surveillance of foreign nationals or powers in association with a terrorist investigation[1]. No idea how closely this is enforced. HOWEVER, there is plenty of other legislation enabling the NSA to spy on non-US parties in different circumstances. [1] http://en.wikipedia.org/wiki/Foreign_Intelligence_Surveillance_Act#Scope_and_limits http://en.wikipedia.org/wiki/Foreign_Intelligence_Surveillan...

raverbashing 13y ago

There is no implied relation in the presentation between MITM attacks and the attack on Petrobras They're merely on the same presentation describing attacks and targets

jlgaddis 13y ago

I believe Chrome only "pins" certain certificates and almost certainly doesn't pin every SSL certificate you may happen to come across -- this is what the EFF's Observatory[0] and browser plugins like Certificate Patrol[1] are for -- although I may very well be wrong on that. Also, a March 2010 research paper by Christopher Soghoian and Sid Stamm "in which they present evidence that certificate authorities (CAs) may be cooperating with government agencies to help them spy undetected on 'secure' encrypted communications."[2] More details on that from the EFF[3] but if we assume that the government can obtain Google's private keys then they could almost certainly carry this out undetected, IMO. [0]: https://www.eff.org/observatory https://www.eff.org/observatory [1]: https://addons.mozilla.org/en-US/firefox/addon/certificate-patrol/ https://addons.mozilla.org/en-US/firefox/addon/certificate-p... [2]: http://files.cloudprivacy.net/ssl-mitm.pdf http://files.cloudprivacy.net/ssl-mitm.pdf [3]: https://www.eff.org/deeplinks/2010/03/researchers-reveal-likelihood-governments-fake-ssl https://www.eff.org/deeplinks/2010/03/researchers-reveal-lik...

anologwintermut 13y ago
I think it pin's google's certificates. The article claims The goal of the attack was to "impersonate Google security certificates." I'm not saying NSA doesn't have the ability, just the implication that it was used against Brazil is likely wrong.
- jlgaddis 13y ago
  > I think it pin's google's certificates. That's what I understand as well but I don't think they pin much more than that -- and certainly not every SSL certificate on every site one might connect to.
  - deleted 13y ago
    [deleted]

einaros 13y ago

Where did you read that it's mail traffic they were after? I'm beginning to strongly believe that it's Google's other services are considered for use in specific attacks. Imagine if some foreign service, that is outside of an NSL's reach, has communication that the NSA wants to snoop on. If they can't break the crypto, but that service happens to load jQuery off of Google's CDN, or use Google Analytics, the NSA could pull a MITM attack and manipulate the content of the requested scripts. Those scripts could rather easily act as proxies for the NSA or others, and either hijack sessions or pull data straight out of the protected services. I'm tooting my own horn here, but that's exactly the kind of thing this blog post speculates on: https://2x.io/read/would-the-nsa-infiltrate-cdns-to-circumvent-https https://2x.io/read/would-the-nsa-infiltrate-cdns-to-circumve...

taway2012 13y ago

AFAIK, Chrome "certificate pinning" may not exactly be what you think "certificate pinning" means. It should be more precisely called "certificate authority pinning". What it means is that Chrome will not trust certs for Google properties except those issued by certain certificate authorities. Reference: https://www.imperialviolet.org/2011/05/04/pinning.html https://www.imperialviolet.org/2011/05/04/pinning.html Unless things changed since I last checked. In contrast, "real" "certificate pinning" as done in some mobile apps (IIRC Twitter) involves storing the hash of the certificate itself in the app. No other certificate, even from the same CA, will be accepted.

anologwintermut 13y ago
You are correct chrome pins the authority, not the cert. And at least as for 2011, they don't just pin their own sub authority, they include a couple of real authorities who's keys the NSA might have. https://www.imperialviolet.org/2011/05/04/pinning.html https://www.imperialviolet.org/2011/05/04/pinning.html

deleted 13y ago

[deleted]

nl 13y ago

Technically FISA only allows surveillance of foreign nationals or powers in association with a terrorist investigation[1]. No idea how closely this is enforced. HOWEVER, there is plenty of other legislation enabling the NSA to spy on non-US parties in different circumstances. [1] http://en.wikipedia.org/wiki/Foreign_Intelligence_Surveillance_Act#Scope_and_limits http://en.wikipedia.org/wiki/Foreign_Intelligence_Surveillan...

nl 13y ago