Tell me more ×
IT Security Stack Exchange is a question and answer site for IT security professionals. It's 100% free, no registration required.
up vote 2 down vote favorite

i have heard that there are software like this http://formessengers.com/mdetect.htm that monitor Chats and can see the chat logs,but how do these kind of software work if we are using services like gtalk which i believe is using HTTPS.

Is it really possible to decrypt communication over SSL.

Is webchat in Gmail communicate over https?

share|improve this question

2 Answers

up vote 4 down vote accepted

SSL cannot decrypted if properly used. I tried reading about that software that claims to help in reading chat logs, but it is not clear how they work.

One possibility is to deploy some proxy server and then allow all connections though the proxy server.So your client would actually connect to the proxy and the proxy would connect to the public server.In such a scenario, anything originating from your machine can be read by a software deployed on the proxy server

share|improve this answer
1  
In that case also will it be possible to decrypt encrypted packet with out knowing its private key. – Kevin Parker Jan 18 at 9:22
Not possible to decrypt without knowing the private key.But if a proxy is deployed the connection is between the proxy server and the client, hence the client encrypts messages using the public key of proxy server.Hence the proxy server can decrypt the messages – aRun Jan 18 at 10:17
but what do that supposed to do if the packet is encrypted and still google only has access to their private key. – Kevin Parker Jan 18 at 10:33
1  
SSL is often improperly used. In particular the hostname is often not verified or incorrectly verified in software other than browsers. The setup instructions for Chat Monitor indicate that it is entirely passive which rules out any active man-in-the-middle attack. At this point we need to see evidence that Chat Monitor actually does work. – Ladadadada Jan 18 at 10:45
yeah.. if you are directly connecting to google, without a proxy in between, it is very difficult to know the details of the chat.But if there is a proxy server in between,you do not actually connect to the google server.You connect to the proxy server using the public key of the proxy server.The proxy server, after receiving the packet, decrypts it, and then deny/rejects it as per the policy, then encrypts it and sends it to google.Google sees the packet as coming from the proxy server – aRun Jan 18 at 10:46
show 4 more comments
up vote 3 down vote

The software to which you linked (Messenger Detect) doesn't work as advertised.

Setup
I installed it in a controlled environment (VM "farm") with a Snort installed and configured to detect a few MiTM attacks.

Test Case 1
I launched Yahoo Messenger and ICQ on two VMs with Messenger Detect on one a 3rd VM.

  • I wasn't able to see any chatting logs.
  • Snort made no complaints.
  • Couldn't see anything suspicious using Wireshark running on the Messenger Detect VM.

Note: In this case I tried to listen to gTalk traffic, but couldn't detect any.

Test Case 2
Same as test case 1 but I installed Messenger Detect on one of the two VMs.

  • I was able to see the chatting logs (from Yahoo Messenger, at least).
  • Snort made no complaints.
  • Couldn't see anything suspicious using Wireshark running on the Messenger Detect VM.

Test Case 3
But now nothing seemed to indicate that Messenger Detect uses any MiTM attacks. This time I tested with two PCs connected to a normal hub.

  • I was able to see the chatting logs.
  • Snort made no complaints.
  • Couldn't see anything suspicious using Wireshark running on the Messenger Detect VM.


Conclusion
It seems that Messenger Detect passively listens to traffic and figures out chatting logs. There's no indication that it's doing any kind of decryption or MiTM attacks.

share|improve this answer
so even with proxy setup this software can not do anything,if the connection is encrypted. – Kevin Parker Jan 18 at 15:11

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.