Hacker News Reader

Comment by jessaustin | Hacker News Reader

This exact issue occurred with TLS 1.2 back when BlueCoat only understood 1.1/1.0.

Good grief! From David Benjamin's final comment:

Note these issues are always bugs in the middlebox products. TLS version negotiation is backwards compatible, so a correctly-implemented TLS-terminating proxy should not require changes to work in a TLS-1.3-capable ecosystem. It can simply speak TLS 1.2 at both client <-> proxy and proxy <-> server TLS connections. That these products broke is an indication of defects in their TLS implementations.

It's understandable that I've never heard of BlueCoat: clearly this product's success is based more on selling to executives than on quality, and it has been some time since I worked in an organization that had executives to sell to.

View on HN

There was a paper posted on HN a few weeks back by some pretty serious security researchers on the security risks of SSL MITM boxes.

https://jhalderm.com/pub/papers/interception-ndss17.pdf

How do you fix this when you're naught but a humble employee? Well, a friend of mine worked at a fairly large tech company where a salesguy for these boxes had convinced the CTO they had to have them. Every tech-person "on the floor" hated the idea, so before the boxes were installed they conspired on their free time to write some scripts that ran lots of legitimate HTTPS traffic, effectively DDOSing the boxes and bringing the company's internet to a crawl for the day, like Google would take ten seconds to open. Then obviously everyone (including the non-tech people) started calling the IT helpdesk complaining that the internet was broken. MITM box salesguy then had to come up with a revised solution, costing 20x more than his first offer, and that was the end of that.

If you already are suffering under MITM boxes, a similar strategy with a slow ramp-up in traffic might work.

It might backfire and your company forbids HTTPS "so that employees can't disclose company secrets without IT having traceability".

They can't, really. So much of the Web has fortunately moved to HTTPS that then they should just forget about Web access.

Uhh, what do you do for sites that don't offer HTTP? Many sites force a 301 redirect when hit on HTTP, and won't downgrade.

Open a ticket with IT?

Same thing I did when I noticed our bluecoat started mitm-ing my bank connection - ticket to IT to enable bypass for specific domain. They refused to do it for google/gmail, but banking sites start working normally on the next day. Youtube, facebook and other non work related stuff is just blocked, unless you need them to do your job (like PR dept).

Of course, for many people gmail would be a key to every door, via password resets.

The internet has changed significantly over the last few years and a lot of sites don't support unencrypted connections.

It's pretty entertaining to read this stack overflow questions about using ssl from 7 years ago: http://stackoverflow.com/questions/2177159/should-all-sites-...

Yeah. This is a firable offense. The solution to your company MITM your traffic is not to use your work computer for anything personal that matters. It's not like if we had a shortage of devices to connect to the internet.

Kinda amazed you got downvoted for pointing out that the parent is essentially advocating for intentionally trying to take down your employer's network because you dislike their IT policy.

This isn't just a fireable offense. Especially given the tendency for computer-related criminal laws to be overly vague, it's entirely possible you could be charged with a crime if you are intentionally trying to DoS your employer's network.

If you live in a third-world country (or the US) which lacks basic functions of society like employee protection, a sensible minimum wage, universal healthcare, paid parental leave, etc., then yes, I don't recommend doing what my friend did with employing a little "civil disobedience" in such cases.

TBH, for most techies I don't think opposition to MITM boxes comes down to "I don't want them to catch me looking at cat photos" but more along the lines of "this will actually reduce security as much as it improves it, and the companies providing these products are also aiding repressive regimes and human rights violations across the globe". Personally, I would find it unethical for the company I work for to buy these products.

What countries can you DoS your employers' network in?

> Personally, I would find it unethical for the company I work for to buy these products.

Then leave the company in protest or convince it not to buy them. DDoSing the company's network is somehow not unethical, I guess?

I agree talking to IT is step 1, and I'm assuming that hasn't worked.

Collective action (strikes, "work slowly protests" etc.) as a protest against company policy has a long precedent of a) being protected by law and b) being much more effective than a single employee quitting, while simultaneously reducing the downside for employees (in L_\infty norm).

Edit: the old Keynes quote comes to mind: "if you owe the bank $100 you have a problem, but if you owe the bank $100 million the bank has a problem" -- if 1 of the company's devs commits a "fireable offense", he/she has a problem, but if 100 of them do, the company has a problem.

However with collective action, the company is usually aware of their employees actions, here if I'm reading correctly management were not notified that this was happening, so perhaps not quote the same thing.

When I mentioned on a mailing list that we should probably pronounce this like "expect your personal bank info to be pwned" rather than "please don't use work resources for personal purposes", I was reminded that there are lots of perfectly reasonable work-related purposes that are undermined by TLS MitM. Corporate bank accounts, ACH transactions, payroll, vendor accounts, tax portals, employee benefits/401k, etc. All of that stuff should actually be secure.

Incidentally, "Blue Coat ProxySG 6642" was the only middlebox to get an "A" from the study referenced above. Apparently they didn't test for 1.3...

Absolutely, but then the right approach is to let the IT dept know that they are running the company into the ground. Often, the IT department or management may be insensitive to that argument (and then you get a Sony Entertainment hack, but then it is well deserved) or they may follow regulations that are beyond their control. But it is a management decision.

How are any of the things you listed undermined by corporate MitM?

Everything you listed is information that the company already has access to. Why isn't it sufficient for there to be access controls by policy, the same way the company protects other sensitive information from unauthorized acres within the company?

Keep up man! Upthread [0], reference was made to a study that's recently made the rounds detailing the basic insecurity of MitM devices. The problem isn't only that corporate network admins see everything, it's also that after the device downgrades TLS (or worse) attackers can also see what they want...

[0] https://news.ycombinator.com/item?id=13751715

My day job includes working on FreeBSD systems and also doing open source FreeBSD work (push upstream, pull down to us). There are sometimes embargoed security notices in my email. There is no chance I will permit my employer to MITM my SSL and risk some clowns in corporate IT from obtaining these mails. (highest security ones are GPG encrypted, but others are not)

I need my personal email to do my work. It needs to stay secure from even my own employer. Period.

Criminal possibly as well, possibly under the CFAA.

not a lawyer.

Bluecoat is extremely widely used in some fields. They were in the news a while back when it was discovered that Syria (before the civil war) was censoring their internet access using Bluecoat devices (allegedly unauthorized by Bluecoat)[1]

[1] https://en.wikipedia.org/wiki/Blue_Coat_Systems#Use_by_repre...

They have many costumers on the Fortune 500 portfolio that make sure the workers only visit the web sites they should and also IT get to know when they misbehave.

Quite a pain to work in such environments.

The entire use case of BlueCoat and the like is to satisfy executives' desire to spy on all usage of their network. It's certainly not to benefit the users who are stuck behind it, to increase their security, or to give them a better Internet experience.

Fuck the users. If users had their way, they'd have all the local administrator privileges they wanted so that they could download malware to their heart's content. From a non-IT perspective, they would also be free to download porn, potentially child porn, which is a crime to merely possess, and exfiltrate terabytes of company secrets.

It sounds like it might be a worthwhile effort to reverse engineer one of those.

Reverse-engineer? A middlebox?

Which holds trusted secret keys and which, in its normal unremarkable operation, intercepts, parses, reconstructs, decrypts, re-encrypts, forwards, and optionally logs both confidential and attacker-controlled traffic? And is also known to be used for nationwide bulk internet censorship by regimes often called 'oppressive'?

Why, doesn't it just.

Please consider, very carefully, the ethics and equities issues one might face with any interesting findings here.

What's true is true - better to know it than stick our heads in the sand. If these boxes have vulnerabilities (who am I kidding, they do parsing, they're probably implemented in C "for performance", of course they have vulnerabilities), we are better off for knowing about them than not.

But what of the equities issue - what to do with that knowledge, once discovered? Might it depend on who "we" are?

My point is that actually helping this particular vendor, for example, may not be everyone's cup of tea.

Yes, good point. One might aim to 'help' them into an early grave whilst actually helping them to strengthen their product.

Reply on news.ycombinator.com