0
votes
2answers
61 views

Are SSL encrypted communications through a company network safe?

If I'm using Skype, Facebook, or another type of communication at my work, can the network administrator see my Skype and Facebook conversations, although its encrypted with SSL? I found this text: ...
8
votes
2answers
674 views

HTTPS login vs MITM attack

http://www.troyhunt.com/2013/05/your-login-form-posts-to-https-but-you.html My question is, if the threat is that someone controls your internet connection and can serve up bad login pages, couldn't ...
1
vote
2answers
54 views

How Web-proxy and Virtual-Hosting are complications for HTTPS?

While studying HTTPS and related transport layer security protocols(SSL/TLS), I came to know that HTTPS suffers from two complications - Web-Proxy and Virtual-Hosting. I can understand how ...
0
votes
1answer
37 views

Key Management in Interception Proxies?

I'm reading Jarmoc's Black Hat presentation on SSL/TLS Interception Proxies and Transitive Trust. I have a few questions on some of the key management practices. In the paper, Jarmoc states: To ...
1
vote
3answers
268 views

Does a TLS interception proxy present the user's browser with the end server's certificate?

I know that TLS (commonly but mistakenly called SSL) interception works by establishing two encrypted tunnels between a client and server, with the interception device (proxy) terminating both tunnels ...
2
votes
1answer
174 views

HTTP Reverse Proxy: Correct way to do SSL to backend

If I have a HTTP reverse proxy that communicates with it's backends in an untrusted datacenter, or across datacenters, I would want to use HTTPS in the backend, as talked about here: Reverse Proxy ...
3
votes
4answers
276 views

Outbound proxy which whitelists by server certificate?

Short version: Are you aware of any proxy or firewall device which will permit outbound SSL connections to hosts with approved* SSL certificates only? Long version: Consider the following ...
-1
votes
1answer
257 views

How to MiTM SSL on a device with no proxy settings

I'm trying to MiTM a device on my network and having some problems. SSLstrip doesn't work because the URL is https://, and I can't use something like Fiddler because the device has no configurable ...
1
vote
1answer
161 views

Long-lived SSL connections to dynamic IP addresses

I'm seeing some odd behaviour on my proxy server logs since I started blocking direct outbound connections to port 443 (thus forcing applications to use the proxy server for HTTPS connections). I'm ...
0
votes
1answer
719 views

Problems with intermediate ssl certificates and ssl proxy

I'm currently implementing a SSL-proxy, and have run into some problems regarding certificates. We have a offline "Company Root CA", and an online "Company intermediate CA". On the proxy I have ...
1
vote
2answers
90 views

non-MiTM Reverse SSL

Do non-MiTM Reverse SSL Proxies exist? Or do all proxies that do SSL-SSL mappings decode and then re-encode HTTPS traffic? If this is the case and I want to map https://mypublicdomain.com -> ...
1
vote
1answer
216 views

ReverseProxy and PCI Compliance

My company has a PCI compliant billing gateway and they expose a service for submitting credit card payment details. I am writing a (Single Page Application/end-to-end javascript) website for them ...
2
votes
2answers
802 views

SSL VPN Detection and possible to block

Is it possible to determine the difference between a VPN on port 443 compared to standard SSL traffic? In order to access SSL websites you need port 443 open but if you setup a VPN Service on port ...
5
votes
1answer
376 views

Retrieving client certificate using Tcpdump results in zero length certificate

I am trying to proxy a mobile app (with Fiddler), which sends a client certificate to the server it connects to. I would think that capturing traffic with Tcpdump, retrieving the client certificate ...
1
vote
1answer
446 views

Why can I see the Basic Auth credentials in plaintext when using SSL

I just read this about the security about Basic Authentication over SSL: Is BASIC-Auth secure if done over HTTPS? And I don't get it. I just installed ProxyDroid (http proxy) on my rooted android ...
1
vote
1answer
489 views

What is the difference between an HTTPS traffic setup with Stunnel and a SSL-VPN

We have a scenario where we cannot connect to our stunnel server running on port 443 on our network, which only allows access to Internet via a proxy server. On the contrary, when we tried a SSL VPN ...
1
vote
1answer
102 views

SSL Communication and Proxy

Let us say that I have a client and a server communicating using SSL. If a hacker sets up a proxy between the client and the server, will he be able to decrypt the data which is being sent?
5
votes
3answers
1k views

Man-in-the-middle Blue coat proxy ssl or what?

I have just discovered that my workplace have enabled some new feature in the blue coat network proxy. It seems like all https certificates in chrome on windows is being issued by this internal ...
1
vote
1answer
611 views

Windows Update - Interception

I'm trying to monitor the HTTP requests/responses made when performing a Windows Update. I have a Windows 8 machine configured with a proxy in IE. I've also imported via netsh for winhttp: netsh ...
10
votes
1answer
658 views

Is Nokia's “institutional MITM” of SSL traffic vulnerable to CRIME attack?

It's recently been in the news that some Nokia phones proxy all traffic, including SSL connections, through a Nokia proxy. This is effectively an "institutional MITM" attack on users those phones. ...
9
votes
4answers
985 views

Can real end-to-end SSL encryption be made?

I've read the various questions tagged [ssl] and [mitm] and [proxy] and I couldn't find a duplicate. I've got a very precise question but first I need to give some background. Basically I'm very ...
14
votes
3answers
5k views

Authenticating a Proxy server over HTTPS

When browsing to a website over HTTPS, the web browser typically does a lot of work in the background - negotiating a secure channel, validating the site's certificate, verifying the trust chain, etc. ...
0
votes
1answer
131 views

Proxy Non-HTTPS logins through EC2

I've been thinking a lot about password security these days, and have been becoming more and more hesitant to use services that have login forms that are not on HTTPS. As I was researching security, ...
1
vote
2answers
422 views

How to secure the connection between the proxy and application

I have designed a framework for my application where I have a proxy to communicate with the outside world. The connection between proxy and the application is encrypted using SSL. But the connection ...
6
votes
2answers
1k views

How can end-users detect malicious attempts at SSL spoofing when the network already has an authorized SSL proxy?

I'm working on one client's network where they have enabled HTTPS authority spoofing on their proxy. This allows them to effectively perform a man-in-the-middle attack to decipher all outgoing ...
5
votes
3answers
2k views

How do I check that I have a direct SSL connection to a website?

I always thought that if I had an SSL connection there would be no MITM attacks. Now it appears that isn't true (see comments in this question Is it okay from a security perspective to read foreign ...
4
votes
2answers
2k views

Is it possible to connect to a proxy with an ssl (or otherwise encrypted) connection?

What i want to know is whether it is possible to connect to a proxy with an ssl (or otherwise encrypted) connection? (I'm suspecting this is possible because TOR encrypts user connections to it's ...
5
votes
4answers
874 views

How to keep secure while browsing on open wifi when SSL VPN is blocked?

After a recent visit to a hotel I was surprised to discover that they blocked access to my OpenVPN server. I often use this as a way to secure my internet traffic when I am on public wireless. ...
6
votes
1answer
3k views

How is tunnelling SSH through Poxytunnel/HTTPS different from doing it through SSL with Stunnel?

In an answer to What is the difference between SSL, TLS, and HTTPS, it's said that HTTPS is HTTP over SSL/TLS. That is, an SSL/TLS connection is established first, and then normal HTTP data is ...
1
vote
3answers
567 views

Benefits to using EV certificates with a privately hosted Certificate Authority

For companies that have implemented their own internal CA, is there any benefit to configuring that CA to issue an EV certificate? Do any SSL Proxies (like Bluecoat) mimic the EV certificate of the ...
1
vote
3answers
707 views

Reverse Proxy Secure Configuration

I have a Forefront TMG 2010 acting as a reverse proxy: I can force HTTP*S* between internet clients and TMG. I can force HTTP*S* between TMG and my web servers. From a security point of view, it ...
5
votes
4answers
1k views

MiTM - Non-HTTP TLS

I'm doing some research into the privacy of various iOS applications. My main source of data is via wireshark or Burp (HTTP/S proxy). This has been rather sucessfull for MiTM for decrypting HTTPS ...
25
votes
8answers
12k views

Can my company see what HTTPS sites I went to?

At work my company uses internet monitoring software (websense). I know if I visit a https ssl-encrypted site (such as https://secure.logmein.com) they can't see what I'm doing on the site since all ...
5
votes
3answers
3k views

Any good free SSL proxy on windows?

I'm looking for SSL proxy capable of dumping requests. I want to test custom browser against SSL-MITM attacks. I'm able to re-route all traffic ongoing from browser to machine with proxy. ...
10
votes
6answers
362 views

Should we configure all devices to never request SSL 2.0, and reject it if offered?

In an effort to reduce man in the middle attacks, when will it be (or was it) an industry accepted practice to reject SSL 2.0 connections on the client and server side? Is configuring this on a proxy ...