4 ms·

I've been hoping for years people would wake up to the risks of these things. I presented on the topic at Blackhat Europe a few years back, where I disclosed s

by jjarmoc 12y ago

I've been hoping for years people would wake up to the risks of these things. I presented on the topic at Blackhat Europe a few years back, where I disclosed several certificate validation flaws in Cisco Ironport. I understand there's legitimate reasons for enterprises to want to decrypt and inspect TLS connections, but it's not without it's risks and downsides. If you're curious about my past work, see: http://www.secureworks.com/cyber-threat-intelligence/threats/transitive-trust/ http://www.secureworks.com/cyber-threat-intelligence/threats... http://media.blackhat.com/bh-eu-12/Jarmoc/bh-eu-12-Jarmoc-SSL_TLS_Interception-Slides.pdf http://media.blackhat.com/bh-eu-12/Jarmoc/bh-eu-12-Jarmoc-SS...

userbinator 12y ago
Good set of slides. Companies are more likely to be afraid of the other risk, which is why SSL interception is used - when malware makes use of it to avoid detection. Security cuts both ways. I think the most important point is that the user should be in control of the traffic, which means knowing whether or not interception is being used.
- jjarmoc 12y ago
  Yeah, it's a balancing act, and there's certainly a desire (and probably even a legitimate need) to monitor encrypted comms for malware C&C channels, data exfiltration, etc. Your view seems to reflect a similar nuance as my own. Administrators need to weigh the risks and benefits as it relates to their own environment, and users should at least be aware that such monitoring is taking place. Beyond that, there's some technical challenges, but I see the bigger issues as political and expectation vs. reality alignment. There's also a video of my talk online, which I'd honestly forgotten about. Maybe someone will find it interesting; https://www.youtube.com/watch?v=7TNdHzwTNdM https://www.youtube.com/watch?v=7TNdHzwTNdM

4 ms·

I've been hoping for years people would wake up to the risks of these things. I presented on the topic at Blackhat Europe a few years back, where I disclosed s

by jjarmoc 12y ago

userbinator 12y ago
Good set of slides. Companies are more likely to be afraid of the other risk, which is why SSL interception is used - when malware makes use of it to avoid detection. Security cuts both ways. I think the most important point is that the user should be in control of the traffic, which means knowing whether or not interception is being used.
- jjarmoc 12y ago
  Yeah, it's a balancing act, and there's certainly a desire (and probably even a legitimate need) to monitor encrypted comms for malware C&C channels, data exfiltration, etc. Your view seems to reflect a similar nuance as my own. Administrators need to weigh the risks and benefits as it relates to their own environment, and users should at least be aware that such monitoring is taking place. Beyond that, there's some technical challenges, but I see the bigger issues as political and expectation vs. reality alignment. There's also a video of my talk online, which I'd honestly forgotten about. Maybe someone will find it interesting; https://www.youtube.com/watch?v=7TNdHzwTNdM https://www.youtube.com/watch?v=7TNdHzwTNdM