4 ms·
It would be interesting if there is a way to detect Silverfish (e.g. by recognizing some specific HTTP requests being made). Because that would allow the MitM t
by t0mas88 12y ago
It would be interesting if there is a way to detect Silverfish (e.g. by recognizing some specific HTTP requests being made). Because that would allow the MitM to only run a MitM on devices that you know are vulnerable and thus decrease the changes of discovery immensely.
If you combine that with configuring your proxy not to MitM any of the sites that browsers have certificate-pinning for (e.g. Google sites with Chrome) you can probably have this running for a very long time without anybody noticing.
- JohnTHaller 12y agoGoogle Chrome defers to the local PC for installed certificates. So, cert pinning didn't protect users at all in this instance. It's a 'feature' of Chrome so that it will use an installed corporate SSL and allow intentional MitM of all HTTPS traffic for purposes of institutional eavesdropping.
- Buge 12y agoIt's not necessarily for institutional purposes. I use it to view my own https traffic in Fiddler.
- mrbabbage 12y agoThere are some very important uses of such institutional eavesdropping, such as running an intrusion detection system on a corporate network; I'd argue that this is a worthy tradeoff between employee privacy and good information security.
- wampus 12y agoYou've undermined both if your proxy is powered by Komodia or another product with similar flaws. What if you've hardened your workstations, but your proxy client supports inferior ciphers? All that work is undone. What if your proxy is easily fingerprinted? That's valuable information to an attacker. There are so many details to get right, and it can take years to discover the flaws that can be exploited by an attacker poking in the right places.