4 ms·

Does anyone know why Cisco would need a root CA on Windows machines...?

chinathrow 11y ago
To have $largeCompany buying their security suite where they can MITM on the proxy/appliance/gw/whatever without generating any alerts on the client side?
- HoochTHX 11y ago
  This.
  - MichaelGG 11y ago
    If they misused the CA for that, there'd be a lot of backlash (cause it'd be detected). Apps would start blacklisting it. Seems like they'd have a better plan than that.
    - eli 11y ago
      I don't think it is intended to be undetected. Plenty of large organizations use security appliances that MITM all traffic. Though I'd prefer they do it by pushing their own BigCo certificate to the boxes they own than relying on a cert that exists in all copies of Windows.
      - jessaustin 11y ago
        They want people to be able to BYOD and not know what's going on. (I'm sure that most employees were informed in some opaque memo, but that only goes so far.) "Our shared network works best with Microsoft phones." Hey, this is a new marketing effort for all those crap Lumias they're trying to unload!
        MichaelGG 11y ago
        So you're positing that Microsoft is going to intentionally destroy their TLS-CA verification system so any company can compromise any Windows device in the name of BYOD, without explicit action from the user?
        jessaustin 11y ago
        As we've been told many times, "it ain't a bug it's a feature". Sure, you and I don't want to tell the DLP guys our bank passwords, but most people already don't care. It's not feasible anymore to just block TLS, and supporting client proxy config is so tedious.
      - MichaelGG 11y ago
        Think about how it'd have to work. By including a "compromised" cert that any company can get use, and that every Windows customer trusts, the CA system would be entirely destroyed. Microsoft wouldn't do that - it makes zero sense. Cisco might have something that having a CA for makes easier, but including a MITM cert in every Windows install is not close to reality.
        e12e 11y ago
        I'm not so sure. Before the "encryption fad" most traffic would go unencrypted to a Cisco device (router, switch, proxy, vpn concentrator (the inside of the network)) anyway. As far as I know, The US has almost non-existent privacy laws when it comes to what corporations are allowed to do/demand to do to their employees through contracts wrt. traffic on company equipment. Forcefully and silently intercepting traffic on employee networks would AFAIK be illegal in most of Europe.
MichaelGG 11y ago
Maybe as part of a way to secure the connection to their appliances? They could auto issue certs after verifying ownership. Maybe they're gonna give appliances a name off their own DNS <whatever>.mycloud.cisco? Hell maybe they're becoming a real CA and gonna sell trust services. Dunno how MS's process is, but with Firefox there's a nice application process that's very open and you can see their claims.
- chinathrow 11y ago
  Indeed. https://wiki.mozilla.org/CA:How_to_apply https://wiki.mozilla.org/CA:How_to_apply However, nothing to bee seen in bugzilla about Cisco regarding their new CA. I wonder if it is MS only? https://bugzilla.mozilla.org/buglist.cgi?quicksearch=cisco https://bugzilla.mozilla.org/buglist.cgi?quicksearch=cisco
  - e12e 11y ago
    Requiring Internet Explorer for switch management sounds like exactly the kind of stupid Cisco might go for. These days Chrome/chromium uses the system store AFAIK, so at least you can get surprising breakage in your management tool that isn't due to TLS, but rather some kind of IE compatibility hack... ;-)

To have $largeCompany buying their security suite where they can MITM on the proxy/appliance/gw/whatever without generating any alerts on the client side?

HoochTHX 11y ago
This.
- MichaelGG 11y ago
  If they misused the CA for that, there'd be a lot of backlash (cause it'd be detected). Apps would start blacklisting it. Seems like they'd have a better plan than that.
  - eli 11y ago
    I don't think it is intended to be undetected. Plenty of large organizations use security appliances that MITM all traffic. Though I'd prefer they do it by pushing their own BigCo certificate to the boxes they own than relying on a cert that exists in all copies of Windows.
    - jessaustin 11y ago
      They want people to be able to BYOD and not know what's going on. (I'm sure that most employees were informed in some opaque memo, but that only goes so far.) "Our shared network works best with Microsoft phones." Hey, this is a new marketing effort for all those crap Lumias they're trying to unload!
      - MichaelGG 11y ago
        So you're positing that Microsoft is going to intentionally destroy their TLS-CA verification system so any company can compromise any Windows device in the name of BYOD, without explicit action from the user?
        jessaustin 11y ago
        As we've been told many times, "it ain't a bug it's a feature". Sure, you and I don't want to tell the DLP guys our bank passwords, but most people already don't care. It's not feasible anymore to just block TLS, and supporting client proxy config is so tedious.
    - MichaelGG 11y ago
      Think about how it'd have to work. By including a "compromised" cert that any company can get use, and that every Windows customer trusts, the CA system would be entirely destroyed. Microsoft wouldn't do that - it makes zero sense. Cisco might have something that having a CA for makes easier, but including a MITM cert in every Windows install is not close to reality.
      - e12e 11y ago
        I'm not so sure. Before the "encryption fad" most traffic would go unencrypted to a Cisco device (router, switch, proxy, vpn concentrator (the inside of the network)) anyway. As far as I know, The US has almost non-existent privacy laws when it comes to what corporations are allowed to do/demand to do to their employees through contracts wrt. traffic on company equipment. Forcefully and silently intercepting traffic on employee networks would AFAIK be illegal in most of Europe.

MichaelGG 11y ago

Maybe as part of a way to secure the connection to their appliances? They could auto issue certs after verifying ownership. Maybe they're gonna give appliances a name off their own DNS <whatever>.mycloud.cisco? Hell maybe they're becoming a real CA and gonna sell trust services. Dunno how MS's process is, but with Firefox there's a nice application process that's very open and you can see their claims.

chinathrow 11y ago
Indeed. https://wiki.mozilla.org/CA:How_to_apply https://wiki.mozilla.org/CA:How_to_apply However, nothing to bee seen in bugzilla about Cisco regarding their new CA. I wonder if it is MS only? https://bugzilla.mozilla.org/buglist.cgi?quicksearch=cisco https://bugzilla.mozilla.org/buglist.cgi?quicksearch=cisco
- e12e 11y ago
  Requiring Internet Explorer for switch management sounds like exactly the kind of stupid Cisco might go for. These days Chrome/chromium uses the system store AFAIK, so at least you can get surprising breakage in your management tool that isn't due to TLS, but rather some kind of IE compatibility hack... ;-)