3 ms·

> or not to do this in the first place. Are there other options besides installing my own root certificate? Assuming I want to write software that legitimatel

by nikital 12y ago

> or not to do this in the first place. Are there other options besides installing my own root certificate? Assuming I want to write software that legitimately MITMs all HTTP and HTTPS traffic (parental control, ad blocker, anti-virus scan for webpages...). I want it to be browser independent and work with browsers that don't support extensions.

lstamour 12y ago
Well, it's basically impossible in some cases to MITM while showing the same certificate without re-building a browser. So your best bet would be to modify existing browsers. That said, if content modification isn't required -- and all you want to do is snoop on SSL, you can use SSLKEYLOGFILE in NSS-based browsers like Firefox and Chrome. If legitimate, I'd prefer going the extension route: people want you in their browser, so you can walk them through whatever it takes to install you, or provide pre-made profiles with you enabled. The point of encryption is to avoid spying and while most users (as evidenced here) don't actually check that the HTTPS website certificate is what it claims to be, pretending to be the same site is about all you can do to modify content and MITM. I'd also point out that the problem here isn't so much that they're MITMing as that they're doing it really, really poorly. Of course, any backdoor could be used by others -- even your SSLKEYLOGFILE. ;-)
- hurin 12y ago
  More so I haven't heard very convincing reasons for MiTM even in other settings, and certainly in this case that they choose not to be deployed as an add-on - has to do with avoiding detection and removal, which is malicious - and that's not only conjecture, they actually market themselves that way in places: Komodia’s Watchdog The Kernel protection watchdog is used to protect Komodia’s Redirector files from being deleted/modified, lsp from being uninstalled and also protects the main process will not be stopped.
danielweber 12y ago
It's fine to proxy HTTPS. But when you do so, you assume big responsibilities. You have to do all the stuff the browser does, and even lots of security people, if you sat them down and told them to write everything a browser does, would probably forget a few important things. (The browser security folks are exceptions.) The top post on this page ('patcheudor) is from a researcher who reports that Superfish wasn't doing proper validation of certs, meaning we didn't even need to extract the private key from the binary to forge www.paypal.com. If I spun up a stupid fake cert for www.paypal.com last week, with no knowledge of Superfish whatsoever, someone from a Lenovo computer would not get certificate warnings. The more people look at this, the worse it gets. It's a fractal of bad security.

by nikital 12y ago

lstamour 12y ago

Well, it's basically impossible in some cases to MITM while showing the same certificate without re-building a browser. So your best bet would be to modify existing browsers. That said, if content modification isn't required -- and all you want to do is snoop on SSL, you can use SSLKEYLOGFILE in NSS-based browsers like Firefox and Chrome. If legitimate, I'd prefer going the extension route: people want you in their browser, so you can walk them through whatever it takes to install you, or provide pre-made profiles with you enabled. The point of encryption is to avoid spying and while most users (as evidenced here) don't actually check that the HTTPS website certificate is what it claims to be, pretending to be the same site is about all you can do to modify content and MITM. I'd also point out that the problem here isn't so much that they're MITMing as that they're doing it really, really poorly. Of course, any backdoor could be used by others -- even your SSLKEYLOGFILE. ;-)

hurin 12y ago
More so I haven't heard very convincing reasons for MiTM even in other settings, and certainly in this case that they choose not to be deployed as an add-on - has to do with avoiding detection and removal, which is malicious - and that's not only conjecture, they actually market themselves that way in places: Komodia’s Watchdog The Kernel protection watchdog is used to protect Komodia’s Redirector files from being deleted/modified, lsp from being uninstalled and also protects the main process will not be stopped.

danielweber 12y ago

It's fine to proxy HTTPS. But when you do so, you assume big responsibilities. You have to do all the stuff the browser does, and even lots of security people, if you sat them down and told them to write everything a browser does, would probably forget a few important things. (The browser security folks are exceptions.) The top post on this page ('patcheudor) is from a researcher who reports that Superfish wasn't doing proper validation of certs, meaning we didn't even need to extract the private key from the binary to forge www.paypal.com. If I spun up a stupid fake cert for www.paypal.com last week, with no knowledge of Superfish whatsoever, someone from a Lenovo computer would not get certificate warnings. The more people look at this, the worse it gets. It's a fractal of bad security.