How to Detect Sneaky N.S.A. ‘Quantum Insert’ Attacks

"Why shouldn't we assume the NSA has subverted the CA system?"

Broadly speaking, we should. And that's why there's been a lot of work lately in doing things that either build on or bypass the CA system. For instance, even if you get a valid CA certificate for a site you want to spoof, it still has to be a different certificate, so there's more work on certificate pinning. Sure, that doesn't help if the spoof cert is up the first time a given person visits a site, but it still raises the bar for successfully attacking a site surreptitiously, because anyone who hits the site post-pin will get a big warning, which can be picked up with other things. Now the attack has to be even better targeted.

And there's other work going on lately, and while it may not be immediately visible to the general public because this all takes time, it really seems to me this has all gotten a lot more vigorous over the last year. I don't even think it's all Snowden per se... it seems to me generalized security consciousness has gone up lately, like we passed a critical threshold of people's work feeding back on other people's work and the community as a whole has moved to a new level of effectiveness. It'll still be a while before we really see the changes but I think some changes are coming. (Not Utopia. We've still got a long ways to go. But some general improvements.)

Then you must replace all traffic to that site successfully. The keys for the spoofed and the legitimate certificate will be different. With PFS only traffic with the negotiated key can be decrypted by the browser. Without PFS, the legitimate server will not understand your requests. Quantum Insert is not successful for each request, as stated by the article. Therefore I would assume that at least a few packages of the original server would slip through which then cannot be decrypted or contain an error message of the server. Especially targeted administrators would notice very quickly, I assume (although browsers might suppress those packages silently). Therefore this would work only with a full man-in-the-middle.

I think in general https would work against this particular attack, if you don't accept sites with mixed content (I am not aware of any browser plugin which does suppress plain content on mixed sites).

It has been. If I recall correctly it was revealed even years before Manning and Wikileaks.

As a matter of observation, it is kind of amazing how short of a memory even the internet has. It seem to be a knowledge management issue, i.e., new and evolving information is not contextualized or even related to pertinent past information.

Or they crack or compromise the keys that they need on a per operation bases. Even assuming ubiquitous SSL (or something more decentralized), the keys of a few advertising or web analytics sites would get a lot of coverage.

Creative use of advertising platforms is used you could easily narrow targets down and guarantee that you know exactly what the content is.

Anyways, this is just one gadget.

Because that subversion can be relatively easily detected, and then shouted to the world.

I think contemporary parlance pretty much has TLS and SSL as synonyms, as they are effectively two means to achieving the same ends.

While the Snowden leaks were being released, I made a habit of doing a few very general searches to get a sampling of how the events were being reported. I really wish I had taken it a step further and saved regular tables of those observations, because I suspect it could have been made into a very interesting paper.

Most of the time the lazy reprints of an AP/Reuters story.would dominate, as expected. Once and a while - usually after a really import release such as COTRAVELER[1] - the story would happen... and then suddenly everybody is talking about Prism and explaining how it is "just metadata". Any momentum the new story had ended was redirected into topics that were already known. There would be small-time media doing proper reporting, of course, but it was clear who the "big media" worked for.

The media following the orders of those that sign their paychecks isn't really news, but it was very interesting to watch it happen in realtime.

[1] I still believe that COTRAVELER is one of the most important thing we have learned from Snowden, as it builds relationship maps and it doesn't rely on the target performing some specific action such as an HTTP requests that QUANTUM can race. Bonus: it only relies on "metadata".

That's a bit patronizing. Of course it is true that most people who support surveillance don't understand what's happening, but only because most people in general don't understand what's happening. Plenty of us understand what's happening and also support it - anecdotally, at least. Fully understanding is asking for too much, though. I doubt anyone outside of a select few at the NSA fully understand what's happening, and it seems reasonable to guess that they support it.

This is like breaking into your neighbors house to see if they have any plans to break into your house. How tragically ironic.

This attack has existed in the wild since the mid-1990s; it is literally the reason SSH exists. We didn't call our TCP hijacking tools "quantum inserts" back then, but that's exactly what they were. The only reason we didn't redirect HTTP connections to malicious sites is that in the 1990s, that would have been a waste of time; the r-commands were much lower hanging fruit.

True, but state actors are much more likely to have ISP/backbone fiber taps and DPI equipment in place to make the attack really effective at scale.

China has started using similar techniques, I believe.

Also some (many?) ISPs have asymmetric routing, preventing an easy implementation of anti-spoofing mechanisms.

Good luck with that when there is thousands of people using the same VPN service, also randomization of IP addresses. However this is only if Evercookie are dealt with. @ http://en.wikipedia.org/wiki/Evercookie Blocking Evercookie blocking is relatively easy now, if you disable JavaScript and use things like NoScript and Random Agent Spoofer. But then also don't forget about the recent VPN's ip leak through WebRTC which can be disabled with setting media.peerconnection.enabled to false If you're paranoid you can also use Qubes or Tails OS.