Hacker News Reader

Hacker News

Comment by nostromo | Hacker News Reader

Full thread

nostromo

Warning: people should know this is NSFW for anyone with a company that monitors your web usage.

I also wouldn't run this from an authoritarian country where local officials may not appreciate the joke.

View on HN

Do companies really MITM SSL traffic in order to watch employees surfing habits?

Yes.

You bet they do! In the past I have had to manually install my company's certificates as a root CA. The annoying thing was that the certs they use are expired and use SHA-1, so I also had to explicitly tell my browser to trust expired/unsafe certificates as well. All in the name of increased security!

I would quit a job like that, unless there were seriously profound reasons for such a grotesque invasion.

1. There are proper ways to restrict activity without resorting to eavesdropping.

2. If they don't trust you enough to be responsible and use good judgement, you're probably stuck in a dead-end situation anyway.

3. In the more rare scenarios, where you might be operating live-saving or life-threatening equipment, or handling the salaries of many people, and dealing with monentary quantities in the many millions of dollars, guess what? You probably shouldn't be using an ordinary computer, with a web browser connected to the internet to perform those sorts of tasks, within the same operating system environment as ordinary web surfing to begin with.

Some companies in highly regulated industries intercept, and inspect all traffic purely because it's easier. Though if this raised a flag, and you showed them what link you clicked, any sane IT department would laugh and start sending the link to their friends.

Other companies (tech compnies, even) engage in ridiculous behavior like timing the minutes of your bathroom breaks, and so forth.

Call centers, data entry, tier one support.

Are there really people that believe there's a possibility that they don't?

I'm no security expert, but I was under the impression that HSTS pinning would make that hard to do, especially on sites like google.com.

And I can't quite parse your sentence to know if you're implying that all companies do... (or just that I shouldn't be so naive as to assume none are), but I can see the cert chain for google.com in my browser at ${big_company} and it doesn't seem like I'm being MITM'd.

Rule of thumb: if an adversary has physical access to your computer, treat it as compromised.

Okay? I'm very familiar with that principle, but I don't understand how to take that statement and apply it to the situation at hand. No one has ever operated this computer except me (though I did enroll the corp wifi certs).

So again, how could I be MITM'd without being aware of it, given HSTS?

Yes, someone could have snuck in a hacked copy of Chrome Canary that exposes phony cert chain information... but that's not what we were talking about, and I don't think most IT departments have the sophistication required to pull that off.

If you enrolled the wifi certs into your system certificate store, certificates signed by them ignore HSTS, for exactly this use case.

I can't find any information about this. Can you point me at some additional information? Thank you in advance!

Here's a good write-up on how to see if your company is listening in on your encrypted web traffic:

http://security.stackexchange.com/a/2920

(Note: MITM is just one way companies monitor employees, but by no means the only way. If your company provided your work computer to you, or if they installed anything on your BYOD computer, I would treat everything you do on that computer as cc'ed to your boss by default.)

I mean, that's how I MITM SSL traffic on a daily basis to do development.

None of that speaks to HSTS/Pinning... which is the feature meant to protect against this sort of thing. I'm specifically asking about how a company can bypass HSTS/Pinning without modifying my local browser.

Everything I'm reading indicates that's not possible.

https://developer.mozilla.org/en-US/docs/Web/Security/Public...

>Firefox (and Chrome) disable Pin Validation for Pinned Hosts whose validated certificate chain terminates at a user-defined trust anchor (rather than a built-in trust anchor). This means that for users who imported custom root certificates all pinning violations are ignored.

That last sentence is key. From Wikipedia: some browsers "disable pinning for certificate chains with private root certificates to enable various corporate content inspection scanners and web debugging tools. The RFC 7469 standard also recommends disabling pinning violation reports for such certificate chains."

Perfect! This is the missing link! Thank you for helping me understand.

What does that have to do with wifi certificates?

If you add CA certificates for the Wifi they probably (I'm not sure if you can tell it manually to not do that) are added to the system-wide trust store. IE and Chrome check that for CAs, Firefox will soon (https://bugzilla.mozilla.org/show_bug.cgi?id=1265113)

(all this for Windows, I believe the same is true for OS X, Linux depends on your specific your setup)

> If you add CA certificates for the Wifi they probably (I'm not sure if you can tell it manually to not do that) are added to the system-wide trust store.

Internet Properties -> Content -> Certificates -> Advanced

You're fine. It's people using company computers that are being monitored.

It relies on HTTPS, which relies on certificates telling the browser that the website is what it claims to be, which relies on a list of trusted root CA certificates installed on your computer, which the company controls. Most companies will install a trusted root CA cert that is themselves onto employee computers (otherwise you'll get SSL errors when accessing internal HTTPS pages since they're not signed with those public root CAs).

My understanding is that, yes, this would be caught by pinning, which is why Chromium disables pinning for "private" root certificates, which is what it considers the ones that your employer has set up on your computer: http://www.chromium.org/Home/chromium-security/security-faq#...

You have conflated two technologies - Strict Transport Security, which is a header that tells the browser to stick to TLS connections only. If your admin has deployed a CA that your browser trusts and uses a cert from that CA to MITM your traffic, they will have no problems doing so ;)

Certificate pinning, on the other hand, allows a client to refuse to connect to a TLS service that fails to prevent the correct certificate. This is generally a win, however it still doesn't give you what you want.

Firefox and Chromium (including Chrome) browsers will only validate certificate pins if the presented certificate is a public trust anchor (in otherwords, the certificates deployed by the operating system). If the certificate chains to a private trust anchor (a certificate installed by your admin), Firefox and Chromium based browsers will smile, wink, and play along.

So, yes, in theory these technologies could protect you, but the vendors that implemented Public Key Pinning opted to support the enterprise use case instead of protecting users.

And not just enterprise use cases. I personally MITM my own https traffic sometimes to see what is going on.

I am aware of at least one lawsuit against an employee in which the firm has used a Google query an employee made as an evidence.

Yep, IronPort is one product, but our network guys have been saying something about it being built into the latest Cisco series 6 routers?

That's the enterprise life

Sounds like it. Our university web security lab was testing this.

The search term is in the url.

Which is still not normally visible to an outsider in an HTTPS request... (other than the cases we're discussing in the sub-thread where the company has installed a root CA and is seeing all of the traffic anyway).

HTTPS protects everything but the domain name. If you're not using SNI it might protect the domain too.

Recently did an on-site pentest at a place that does this (a municipality in the Netherlands). First thing I did was go to https://torproject.org but of course that was blocked. Eventually I found a third party site that offered old versions and via an obfs proxy and bridge node I could get on the Internet uncensored (lots of sites were blocked).

So yup this happens. Is it effective though? No, this took me 15 minutes and I wasn't even an employee with months if not years of time on their hands.

> people should know this is NSFW for anyone with a company that monitors your web usage

All the more reason to do it IMHO :)

NSFW? It simply NS

Maybe i am wrong, but doesn't google encrypt at source (esepcially if you are logged in, using ssl enabled, or have some security features enabled). This should go through as regular search then.

Reply on news.ycombinator.com