A workplace installs custom certificates on personal devices, can this be used to decrypt HTTPS traffic?Corporate computers have own corporation's cert as trusted CA; should I consider all traffic compromised?Is it possible for corporation to intercept and decrypt SSL/TLS traffic?ECDHE_RSA and gmailWhy not use client certificates for premaster key generationIt is possible to decrypt HTTPS traffic when a man in the middle proxy is already in place?Details of TLS certificate verificationUnderstanding SSL man-in-the-middle and its limitationsCan a wifi router decrypt SSL/TLS information?Doubts about tls handshakeDecrypt TLS trafficStorage of certificates and keys in hardware security modules (Use-case TLS)Publishing a private key used for HTTPS certificates, is it ever OK?
Is there an wasy way to program in Tikz something like the one in the image?
What is the opposite of 'gravitas'?
Can a malicious addon access internet history and such in chrome/firefox?
What if somebody invests in my application?
Are Warlocks Arcane or Divine?
What do you call the infoboxes with text and sometimes images on the side of a page we find in textbooks?
What does the "3am" section means in manpages?
Should my PhD thesis be submitted under my legal name?
Adding empty element to declared container without declaring type of element
Can the harmonic series explain the origin of the major scale?
Is it legal to discriminate due to the medicine used to treat a medical condition?
Lifted its hind leg on or lifted its hind leg towards?
Female=gender counterpart?
Identify a stage play about a VR experience in which participants are encouraged to simulate performing horrific activities
Can I rely on these GitHub repository files?
Visiting the UK as unmarried couple
Can somebody explain Brexit in a few child-proof sentences?
Invariance of results when scaling explanatory variables in logistic regression, is there a proof?
Is there any significance to the Valyrian Stone vault door of Qarth?
I2C signal and power over long range (10meter cable)
A social experiment. What is the worst that can happen?
Pronouncing Homer as in modern Greek
Perfect riffle shuffles
Why is delta-v is the most useful quantity for planning space travel?
A workplace installs custom certificates on personal devices, can this be used to decrypt HTTPS traffic?
Corporate computers have own corporation's cert as trusted CA; should I consider all traffic compromised?Is it possible for corporation to intercept and decrypt SSL/TLS traffic?ECDHE_RSA and gmailWhy not use client certificates for premaster key generationIt is possible to decrypt HTTPS traffic when a man in the middle proxy is already in place?Details of TLS certificate verificationUnderstanding SSL man-in-the-middle and its limitationsCan a wifi router decrypt SSL/TLS information?Doubts about tls handshakeDecrypt TLS trafficStorage of certificates and keys in hardware security modules (Use-case TLS)Publishing a private key used for HTTPS certificates, is it ever OK?
So another engineer buddy of mine and I were having a drink the other night. He mentioned that you're allowed to use personal devices on the office wifi, but that they install a custom certificate so they can MITM your traffic.
Neither of us are security experts, but I know a little bit about the HTTP/TLS handshake protocol to question whether this is the case.
As far as I understand it (please forgive me if I butcher it):
Client-Server initiate handshake, and exchange certificate from signing authority + public key + random string.
Public key is used to decrypt a random string of characters, which is fed into a hashing algorithm and reveals a private key.
Private key is used to decrypt the traffic that follows
We were reading this article, about how companies sometimes install certificates to decrypt outgoing traffic.
If the blog-post case is true, then how does this work? Would they get the private key using their trusted-root all uses certificate? Assuming that works, that covers the windows use-case, but what about other platforms like OSX/iOS, linux, BSD etc.?
Are there other approaches that I'm not considering, where a certificate install could be used to MitM?
tls certificates
|
show 3 more comments
So another engineer buddy of mine and I were having a drink the other night. He mentioned that you're allowed to use personal devices on the office wifi, but that they install a custom certificate so they can MITM your traffic.
Neither of us are security experts, but I know a little bit about the HTTP/TLS handshake protocol to question whether this is the case.
As far as I understand it (please forgive me if I butcher it):
Client-Server initiate handshake, and exchange certificate from signing authority + public key + random string.
Public key is used to decrypt a random string of characters, which is fed into a hashing algorithm and reveals a private key.
Private key is used to decrypt the traffic that follows
We were reading this article, about how companies sometimes install certificates to decrypt outgoing traffic.
If the blog-post case is true, then how does this work? Would they get the private key using their trusted-root all uses certificate? Assuming that works, that covers the windows use-case, but what about other platforms like OSX/iOS, linux, BSD etc.?
Are there other approaches that I'm not considering, where a certificate install could be used to MitM?
tls certificates
What certificates did he install? Was it a root CA certificate? It could have just been a certificate to authenticate the radius server which is used to authorize access to the wifi. Different certificates do different tasks.
– Daisetsu
2 hours ago
I don't think he installed anything. I think his workplace was being pretty transparent about what the cert is for - we're just trying to understand if it's possible or if they're making an empty threat.
– Scuba Steve
2 hours ago
We both honestly don't care about the implications, we're really just trying to understand the scenario, because we're nerds.
– Scuba Steve
2 hours ago
1
Oh, I see. Yes that is possible and it's not rare. They're called TLS interception proxies.
– Daisetsu
2 hours ago
1
tlseminar.github.io/tls-interception look at the section titled "How SSL/TLS interception works"
– Daisetsu
2 hours ago
|
show 3 more comments
So another engineer buddy of mine and I were having a drink the other night. He mentioned that you're allowed to use personal devices on the office wifi, but that they install a custom certificate so they can MITM your traffic.
Neither of us are security experts, but I know a little bit about the HTTP/TLS handshake protocol to question whether this is the case.
As far as I understand it (please forgive me if I butcher it):
Client-Server initiate handshake, and exchange certificate from signing authority + public key + random string.
Public key is used to decrypt a random string of characters, which is fed into a hashing algorithm and reveals a private key.
Private key is used to decrypt the traffic that follows
We were reading this article, about how companies sometimes install certificates to decrypt outgoing traffic.
If the blog-post case is true, then how does this work? Would they get the private key using their trusted-root all uses certificate? Assuming that works, that covers the windows use-case, but what about other platforms like OSX/iOS, linux, BSD etc.?
Are there other approaches that I'm not considering, where a certificate install could be used to MitM?
tls certificates
So another engineer buddy of mine and I were having a drink the other night. He mentioned that you're allowed to use personal devices on the office wifi, but that they install a custom certificate so they can MITM your traffic.
Neither of us are security experts, but I know a little bit about the HTTP/TLS handshake protocol to question whether this is the case.
As far as I understand it (please forgive me if I butcher it):
Client-Server initiate handshake, and exchange certificate from signing authority + public key + random string.
Public key is used to decrypt a random string of characters, which is fed into a hashing algorithm and reveals a private key.
Private key is used to decrypt the traffic that follows
We were reading this article, about how companies sometimes install certificates to decrypt outgoing traffic.
If the blog-post case is true, then how does this work? Would they get the private key using their trusted-root all uses certificate? Assuming that works, that covers the windows use-case, but what about other platforms like OSX/iOS, linux, BSD etc.?
Are there other approaches that I'm not considering, where a certificate install could be used to MitM?
tls certificates
tls certificates
asked 2 hours ago
Scuba SteveScuba Steve
1385
1385
What certificates did he install? Was it a root CA certificate? It could have just been a certificate to authenticate the radius server which is used to authorize access to the wifi. Different certificates do different tasks.
– Daisetsu
2 hours ago
I don't think he installed anything. I think his workplace was being pretty transparent about what the cert is for - we're just trying to understand if it's possible or if they're making an empty threat.
– Scuba Steve
2 hours ago
We both honestly don't care about the implications, we're really just trying to understand the scenario, because we're nerds.
– Scuba Steve
2 hours ago
1
Oh, I see. Yes that is possible and it's not rare. They're called TLS interception proxies.
– Daisetsu
2 hours ago
1
tlseminar.github.io/tls-interception look at the section titled "How SSL/TLS interception works"
– Daisetsu
2 hours ago
|
show 3 more comments
What certificates did he install? Was it a root CA certificate? It could have just been a certificate to authenticate the radius server which is used to authorize access to the wifi. Different certificates do different tasks.
– Daisetsu
2 hours ago
I don't think he installed anything. I think his workplace was being pretty transparent about what the cert is for - we're just trying to understand if it's possible or if they're making an empty threat.
– Scuba Steve
2 hours ago
We both honestly don't care about the implications, we're really just trying to understand the scenario, because we're nerds.
– Scuba Steve
2 hours ago
1
Oh, I see. Yes that is possible and it's not rare. They're called TLS interception proxies.
– Daisetsu
2 hours ago
1
tlseminar.github.io/tls-interception look at the section titled "How SSL/TLS interception works"
– Daisetsu
2 hours ago
What certificates did he install? Was it a root CA certificate? It could have just been a certificate to authenticate the radius server which is used to authorize access to the wifi. Different certificates do different tasks.
– Daisetsu
2 hours ago
What certificates did he install? Was it a root CA certificate? It could have just been a certificate to authenticate the radius server which is used to authorize access to the wifi. Different certificates do different tasks.
– Daisetsu
2 hours ago
I don't think he installed anything. I think his workplace was being pretty transparent about what the cert is for - we're just trying to understand if it's possible or if they're making an empty threat.
– Scuba Steve
2 hours ago
I don't think he installed anything. I think his workplace was being pretty transparent about what the cert is for - we're just trying to understand if it's possible or if they're making an empty threat.
– Scuba Steve
2 hours ago
We both honestly don't care about the implications, we're really just trying to understand the scenario, because we're nerds.
– Scuba Steve
2 hours ago
We both honestly don't care about the implications, we're really just trying to understand the scenario, because we're nerds.
– Scuba Steve
2 hours ago
1
1
Oh, I see. Yes that is possible and it's not rare. They're called TLS interception proxies.
– Daisetsu
2 hours ago
Oh, I see. Yes that is possible and it's not rare. They're called TLS interception proxies.
– Daisetsu
2 hours ago
1
1
tlseminar.github.io/tls-interception look at the section titled "How SSL/TLS interception works"
– Daisetsu
2 hours ago
tlseminar.github.io/tls-interception look at the section titled "How SSL/TLS interception works"
– Daisetsu
2 hours ago
|
show 3 more comments
1 Answer
1
active
oldest
votes
Yes, they can MitM the traffic this way, using an internal certificate authority. There are two primary ways in which the MitM can work.
The first is to simply turn the edge gateway into a proxy, whereby TLS connections are made from the gateway to the server, and the gateway then generates server certificates on the fly from an internal CA in order to impersonate the remote server. Your system trusts the CA, so it trusts the server certificate.
The second is a slightly different take on the first. The gateway proxies the traffic similarly to the first method, except it only advertises static RSA cipher suites to the remote server. The reason for doing this is performance. With a static RSA key exchange (i.e. not Diffie-Hellman) the gateway can split the handshake as before in order to provide the client with a certificate generated via the internal CA, but instead of decrypting the content on the gateway and then re-encrypting it before proxying, it simply passes the same session key between the client and server. This way the gateway only has to decrypt the traffic once, using the captured session key, and never needs to re-encrypt it in order to proxy the traffic between client and server. This trick no longer works in TLS 1.3 as static RSA key exchange was removed.
Generally speaking this kind of TLS inspection is fairly commonplace in large organisations, particularly financials. Deploying it on BYOD devices is somewhat common, although you should consider the privacy and security implications that might arise from installing your company's internal CA certificate on your device. You need to ask yourself whether you trust that your IT security team is likely to be able to protect the signing keys, because if not then your device is liable to be MitM'ed by an attacker.
" You need to ask yourself whether you trust that your IT security team is likely to be able to protect the signing keys." Yes exactly, I had the same thought myself.
– Scuba Steve
2 hours ago
2
As an aside, I once assessed a TLS inspection gateway product which re-signed all HTTPS connections using the internal CA, even if the remote certificate was invalid. This allowed for a particularly effective phishing campaign in which we impersonated the company intranet and had our phishing domain automagically signed by the company CA. I suggest that you check for this vulnerability yourself by trying to visit a site which you know has an invalid (e.g. expired, or incorrect domain) certificate and seeing if the connection succeeds.
– Polynomial
2 hours ago
Amazing! I feel like pen-testing is a missed calling.
– Scuba Steve
2 hours ago
1
FWIW even if 1.3 would allow static-RSA, it changes the key derivation to include the whole handshake (not just premaster+nonces) and MITM couldn't make those equal. This is similar to rfc7627 which fixes 'triple handshake' for 1.2, except that is optional and so MITM can force it off.
– dave_thompson_085
1 hour ago
add a comment |
Your Answer
StackExchange.ready(function()
var channelOptions =
tags: "".split(" "),
id: "162"
;
initTagRenderer("".split(" "), "".split(" "), channelOptions);
StackExchange.using("externalEditor", function()
// Have to fire editor after snippets, if snippets enabled
if (StackExchange.settings.snippets.snippetsEnabled)
StackExchange.using("snippets", function()
createEditor();
);
else
createEditor();
);
function createEditor()
StackExchange.prepareEditor(
heartbeatType: 'answer',
autoActivateHeartbeat: false,
convertImagesToLinks: false,
noModals: true,
showLowRepImageUploadWarning: true,
reputationToPostImages: null,
bindNavPrevention: true,
postfix: "",
imageUploader:
brandingHtml: "Powered by u003ca class="icon-imgur-white" href="https://imgur.com/"u003eu003c/au003e",
contentPolicyHtml: "User contributions licensed under u003ca href="https://creativecommons.org/licenses/by-sa/3.0/"u003ecc by-sa 3.0 with attribution requiredu003c/au003e u003ca href="https://stackoverflow.com/legal/content-policy"u003e(content policy)u003c/au003e",
allowUrls: true
,
noCode: true, onDemand: true,
discardSelector: ".discard-answer"
,immediatelyShowMarkdownHelp:true
);
);
Sign up or log in
StackExchange.ready(function ()
StackExchange.helpers.onClickDraftSave('#login-link');
var $window = $(window),
onScroll = function(e)
var $elem = $('.new-login-left'),
docViewTop = $window.scrollTop(),
docViewBottom = docViewTop + $window.height(),
elemTop = $elem.offset().top,
elemBottom = elemTop + $elem.height();
if ((docViewTop elemBottom))
StackExchange.using('gps', function() StackExchange.gps.track('embedded_signup_form.view', location: 'question_page' ); );
$window.unbind('scroll', onScroll);
;
$window.on('scroll', onScroll);
);
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
StackExchange.ready(
function ()
StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2fsecurity.stackexchange.com%2fquestions%2f206103%2fa-workplace-installs-custom-certificates-on-personal-devices-can-this-be-used-t%23new-answer', 'question_page');
);
Post as a guest
Required, but never shown
1 Answer
1
active
oldest
votes
1 Answer
1
active
oldest
votes
active
oldest
votes
active
oldest
votes
Yes, they can MitM the traffic this way, using an internal certificate authority. There are two primary ways in which the MitM can work.
The first is to simply turn the edge gateway into a proxy, whereby TLS connections are made from the gateway to the server, and the gateway then generates server certificates on the fly from an internal CA in order to impersonate the remote server. Your system trusts the CA, so it trusts the server certificate.
The second is a slightly different take on the first. The gateway proxies the traffic similarly to the first method, except it only advertises static RSA cipher suites to the remote server. The reason for doing this is performance. With a static RSA key exchange (i.e. not Diffie-Hellman) the gateway can split the handshake as before in order to provide the client with a certificate generated via the internal CA, but instead of decrypting the content on the gateway and then re-encrypting it before proxying, it simply passes the same session key between the client and server. This way the gateway only has to decrypt the traffic once, using the captured session key, and never needs to re-encrypt it in order to proxy the traffic between client and server. This trick no longer works in TLS 1.3 as static RSA key exchange was removed.
Generally speaking this kind of TLS inspection is fairly commonplace in large organisations, particularly financials. Deploying it on BYOD devices is somewhat common, although you should consider the privacy and security implications that might arise from installing your company's internal CA certificate on your device. You need to ask yourself whether you trust that your IT security team is likely to be able to protect the signing keys, because if not then your device is liable to be MitM'ed by an attacker.
" You need to ask yourself whether you trust that your IT security team is likely to be able to protect the signing keys." Yes exactly, I had the same thought myself.
– Scuba Steve
2 hours ago
2
As an aside, I once assessed a TLS inspection gateway product which re-signed all HTTPS connections using the internal CA, even if the remote certificate was invalid. This allowed for a particularly effective phishing campaign in which we impersonated the company intranet and had our phishing domain automagically signed by the company CA. I suggest that you check for this vulnerability yourself by trying to visit a site which you know has an invalid (e.g. expired, or incorrect domain) certificate and seeing if the connection succeeds.
– Polynomial
2 hours ago
Amazing! I feel like pen-testing is a missed calling.
– Scuba Steve
2 hours ago
1
FWIW even if 1.3 would allow static-RSA, it changes the key derivation to include the whole handshake (not just premaster+nonces) and MITM couldn't make those equal. This is similar to rfc7627 which fixes 'triple handshake' for 1.2, except that is optional and so MITM can force it off.
– dave_thompson_085
1 hour ago
add a comment |
Yes, they can MitM the traffic this way, using an internal certificate authority. There are two primary ways in which the MitM can work.
The first is to simply turn the edge gateway into a proxy, whereby TLS connections are made from the gateway to the server, and the gateway then generates server certificates on the fly from an internal CA in order to impersonate the remote server. Your system trusts the CA, so it trusts the server certificate.
The second is a slightly different take on the first. The gateway proxies the traffic similarly to the first method, except it only advertises static RSA cipher suites to the remote server. The reason for doing this is performance. With a static RSA key exchange (i.e. not Diffie-Hellman) the gateway can split the handshake as before in order to provide the client with a certificate generated via the internal CA, but instead of decrypting the content on the gateway and then re-encrypting it before proxying, it simply passes the same session key between the client and server. This way the gateway only has to decrypt the traffic once, using the captured session key, and never needs to re-encrypt it in order to proxy the traffic between client and server. This trick no longer works in TLS 1.3 as static RSA key exchange was removed.
Generally speaking this kind of TLS inspection is fairly commonplace in large organisations, particularly financials. Deploying it on BYOD devices is somewhat common, although you should consider the privacy and security implications that might arise from installing your company's internal CA certificate on your device. You need to ask yourself whether you trust that your IT security team is likely to be able to protect the signing keys, because if not then your device is liable to be MitM'ed by an attacker.
" You need to ask yourself whether you trust that your IT security team is likely to be able to protect the signing keys." Yes exactly, I had the same thought myself.
– Scuba Steve
2 hours ago
2
As an aside, I once assessed a TLS inspection gateway product which re-signed all HTTPS connections using the internal CA, even if the remote certificate was invalid. This allowed for a particularly effective phishing campaign in which we impersonated the company intranet and had our phishing domain automagically signed by the company CA. I suggest that you check for this vulnerability yourself by trying to visit a site which you know has an invalid (e.g. expired, or incorrect domain) certificate and seeing if the connection succeeds.
– Polynomial
2 hours ago
Amazing! I feel like pen-testing is a missed calling.
– Scuba Steve
2 hours ago
1
FWIW even if 1.3 would allow static-RSA, it changes the key derivation to include the whole handshake (not just premaster+nonces) and MITM couldn't make those equal. This is similar to rfc7627 which fixes 'triple handshake' for 1.2, except that is optional and so MITM can force it off.
– dave_thompson_085
1 hour ago
add a comment |
Yes, they can MitM the traffic this way, using an internal certificate authority. There are two primary ways in which the MitM can work.
The first is to simply turn the edge gateway into a proxy, whereby TLS connections are made from the gateway to the server, and the gateway then generates server certificates on the fly from an internal CA in order to impersonate the remote server. Your system trusts the CA, so it trusts the server certificate.
The second is a slightly different take on the first. The gateway proxies the traffic similarly to the first method, except it only advertises static RSA cipher suites to the remote server. The reason for doing this is performance. With a static RSA key exchange (i.e. not Diffie-Hellman) the gateway can split the handshake as before in order to provide the client with a certificate generated via the internal CA, but instead of decrypting the content on the gateway and then re-encrypting it before proxying, it simply passes the same session key between the client and server. This way the gateway only has to decrypt the traffic once, using the captured session key, and never needs to re-encrypt it in order to proxy the traffic between client and server. This trick no longer works in TLS 1.3 as static RSA key exchange was removed.
Generally speaking this kind of TLS inspection is fairly commonplace in large organisations, particularly financials. Deploying it on BYOD devices is somewhat common, although you should consider the privacy and security implications that might arise from installing your company's internal CA certificate on your device. You need to ask yourself whether you trust that your IT security team is likely to be able to protect the signing keys, because if not then your device is liable to be MitM'ed by an attacker.
Yes, they can MitM the traffic this way, using an internal certificate authority. There are two primary ways in which the MitM can work.
The first is to simply turn the edge gateway into a proxy, whereby TLS connections are made from the gateway to the server, and the gateway then generates server certificates on the fly from an internal CA in order to impersonate the remote server. Your system trusts the CA, so it trusts the server certificate.
The second is a slightly different take on the first. The gateway proxies the traffic similarly to the first method, except it only advertises static RSA cipher suites to the remote server. The reason for doing this is performance. With a static RSA key exchange (i.e. not Diffie-Hellman) the gateway can split the handshake as before in order to provide the client with a certificate generated via the internal CA, but instead of decrypting the content on the gateway and then re-encrypting it before proxying, it simply passes the same session key between the client and server. This way the gateway only has to decrypt the traffic once, using the captured session key, and never needs to re-encrypt it in order to proxy the traffic between client and server. This trick no longer works in TLS 1.3 as static RSA key exchange was removed.
Generally speaking this kind of TLS inspection is fairly commonplace in large organisations, particularly financials. Deploying it on BYOD devices is somewhat common, although you should consider the privacy and security implications that might arise from installing your company's internal CA certificate on your device. You need to ask yourself whether you trust that your IT security team is likely to be able to protect the signing keys, because if not then your device is liable to be MitM'ed by an attacker.
answered 2 hours ago
PolynomialPolynomial
101k31248341
101k31248341
" You need to ask yourself whether you trust that your IT security team is likely to be able to protect the signing keys." Yes exactly, I had the same thought myself.
– Scuba Steve
2 hours ago
2
As an aside, I once assessed a TLS inspection gateway product which re-signed all HTTPS connections using the internal CA, even if the remote certificate was invalid. This allowed for a particularly effective phishing campaign in which we impersonated the company intranet and had our phishing domain automagically signed by the company CA. I suggest that you check for this vulnerability yourself by trying to visit a site which you know has an invalid (e.g. expired, or incorrect domain) certificate and seeing if the connection succeeds.
– Polynomial
2 hours ago
Amazing! I feel like pen-testing is a missed calling.
– Scuba Steve
2 hours ago
1
FWIW even if 1.3 would allow static-RSA, it changes the key derivation to include the whole handshake (not just premaster+nonces) and MITM couldn't make those equal. This is similar to rfc7627 which fixes 'triple handshake' for 1.2, except that is optional and so MITM can force it off.
– dave_thompson_085
1 hour ago
add a comment |
" You need to ask yourself whether you trust that your IT security team is likely to be able to protect the signing keys." Yes exactly, I had the same thought myself.
– Scuba Steve
2 hours ago
2
As an aside, I once assessed a TLS inspection gateway product which re-signed all HTTPS connections using the internal CA, even if the remote certificate was invalid. This allowed for a particularly effective phishing campaign in which we impersonated the company intranet and had our phishing domain automagically signed by the company CA. I suggest that you check for this vulnerability yourself by trying to visit a site which you know has an invalid (e.g. expired, or incorrect domain) certificate and seeing if the connection succeeds.
– Polynomial
2 hours ago
Amazing! I feel like pen-testing is a missed calling.
– Scuba Steve
2 hours ago
1
FWIW even if 1.3 would allow static-RSA, it changes the key derivation to include the whole handshake (not just premaster+nonces) and MITM couldn't make those equal. This is similar to rfc7627 which fixes 'triple handshake' for 1.2, except that is optional and so MITM can force it off.
– dave_thompson_085
1 hour ago
" You need to ask yourself whether you trust that your IT security team is likely to be able to protect the signing keys." Yes exactly, I had the same thought myself.
– Scuba Steve
2 hours ago
" You need to ask yourself whether you trust that your IT security team is likely to be able to protect the signing keys." Yes exactly, I had the same thought myself.
– Scuba Steve
2 hours ago
2
2
As an aside, I once assessed a TLS inspection gateway product which re-signed all HTTPS connections using the internal CA, even if the remote certificate was invalid. This allowed for a particularly effective phishing campaign in which we impersonated the company intranet and had our phishing domain automagically signed by the company CA. I suggest that you check for this vulnerability yourself by trying to visit a site which you know has an invalid (e.g. expired, or incorrect domain) certificate and seeing if the connection succeeds.
– Polynomial
2 hours ago
As an aside, I once assessed a TLS inspection gateway product which re-signed all HTTPS connections using the internal CA, even if the remote certificate was invalid. This allowed for a particularly effective phishing campaign in which we impersonated the company intranet and had our phishing domain automagically signed by the company CA. I suggest that you check for this vulnerability yourself by trying to visit a site which you know has an invalid (e.g. expired, or incorrect domain) certificate and seeing if the connection succeeds.
– Polynomial
2 hours ago
Amazing! I feel like pen-testing is a missed calling.
– Scuba Steve
2 hours ago
Amazing! I feel like pen-testing is a missed calling.
– Scuba Steve
2 hours ago
1
1
FWIW even if 1.3 would allow static-RSA, it changes the key derivation to include the whole handshake (not just premaster+nonces) and MITM couldn't make those equal. This is similar to rfc7627 which fixes 'triple handshake' for 1.2, except that is optional and so MITM can force it off.
– dave_thompson_085
1 hour ago
FWIW even if 1.3 would allow static-RSA, it changes the key derivation to include the whole handshake (not just premaster+nonces) and MITM couldn't make those equal. This is similar to rfc7627 which fixes 'triple handshake' for 1.2, except that is optional and so MITM can force it off.
– dave_thompson_085
1 hour ago
add a comment |
Thanks for contributing an answer to Information Security Stack Exchange!
- Please be sure to answer the question. Provide details and share your research!
But avoid …
- Asking for help, clarification, or responding to other answers.
- Making statements based on opinion; back them up with references or personal experience.
To learn more, see our tips on writing great answers.
Sign up or log in
StackExchange.ready(function ()
StackExchange.helpers.onClickDraftSave('#login-link');
var $window = $(window),
onScroll = function(e)
var $elem = $('.new-login-left'),
docViewTop = $window.scrollTop(),
docViewBottom = docViewTop + $window.height(),
elemTop = $elem.offset().top,
elemBottom = elemTop + $elem.height();
if ((docViewTop elemBottom))
StackExchange.using('gps', function() StackExchange.gps.track('embedded_signup_form.view', location: 'question_page' ); );
$window.unbind('scroll', onScroll);
;
$window.on('scroll', onScroll);
);
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
StackExchange.ready(
function ()
StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2fsecurity.stackexchange.com%2fquestions%2f206103%2fa-workplace-installs-custom-certificates-on-personal-devices-can-this-be-used-t%23new-answer', 'question_page');
);
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function ()
StackExchange.helpers.onClickDraftSave('#login-link');
var $window = $(window),
onScroll = function(e)
var $elem = $('.new-login-left'),
docViewTop = $window.scrollTop(),
docViewBottom = docViewTop + $window.height(),
elemTop = $elem.offset().top,
elemBottom = elemTop + $elem.height();
if ((docViewTop elemBottom))
StackExchange.using('gps', function() StackExchange.gps.track('embedded_signup_form.view', location: 'question_page' ); );
$window.unbind('scroll', onScroll);
;
$window.on('scroll', onScroll);
);
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function ()
StackExchange.helpers.onClickDraftSave('#login-link');
var $window = $(window),
onScroll = function(e)
var $elem = $('.new-login-left'),
docViewTop = $window.scrollTop(),
docViewBottom = docViewTop + $window.height(),
elemTop = $elem.offset().top,
elemBottom = elemTop + $elem.height();
if ((docViewTop elemBottom))
StackExchange.using('gps', function() StackExchange.gps.track('embedded_signup_form.view', location: 'question_page' ); );
$window.unbind('scroll', onScroll);
;
$window.on('scroll', onScroll);
);
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function ()
StackExchange.helpers.onClickDraftSave('#login-link');
var $window = $(window),
onScroll = function(e)
var $elem = $('.new-login-left'),
docViewTop = $window.scrollTop(),
docViewBottom = docViewTop + $window.height(),
elemTop = $elem.offset().top,
elemBottom = elemTop + $elem.height();
if ((docViewTop elemBottom))
StackExchange.using('gps', function() StackExchange.gps.track('embedded_signup_form.view', location: 'question_page' ); );
$window.unbind('scroll', onScroll);
;
$window.on('scroll', onScroll);
);
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
What certificates did he install? Was it a root CA certificate? It could have just been a certificate to authenticate the radius server which is used to authorize access to the wifi. Different certificates do different tasks.
– Daisetsu
2 hours ago
I don't think he installed anything. I think his workplace was being pretty transparent about what the cert is for - we're just trying to understand if it's possible or if they're making an empty threat.
– Scuba Steve
2 hours ago
We both honestly don't care about the implications, we're really just trying to understand the scenario, because we're nerds.
– Scuba Steve
2 hours ago
1
Oh, I see. Yes that is possible and it's not rare. They're called TLS interception proxies.
– Daisetsu
2 hours ago
1
tlseminar.github.io/tls-interception look at the section titled "How SSL/TLS interception works"
– Daisetsu
2 hours ago