Tag Info

Hot answers tagged

37

What makes Superfish, and similar products (all herein just referred to as "Superfish"), different from corporate MitM is that Superfish is doing the MitM on the client machine. Corporate MitM is performed on a separate server or appliance. This is important because the system performing the MitM must have the private key of a Trusted Root CA in order to ...


6

Hopefully, someone will do the testing and give a definitive answer for Kaspersky for you. Meanwhile, here's an answer for the general case: It depends. Does running an SSL proxy against yourself weaken your security posture? Certainly. Will any given product weaken your security posture as bad as Superfish? That's very implementation-dependent, and also ...


4

The main difference between Superfish and a Corporate Proxy is how the new SSL certificate is generated. In the Superfish case, the CA certificate and the private key stands on the client computer, and the software generates a new SSL certificate with a key it have on itself. The traffic is intercepted locally, a new certificate is generated on the client, ...


2

When you are under an MITM attack, typically the attacker has complete control of part of the link between you and your intended destination. For this reason, it is usually difficult to "bypass" MITM, if done correctly, because the attacker is fully in control of your traffic and free to direct it to wherever he pleases. The attacker can basically just ...


2

In this case, cert 1 is known as the root certificate. You download it and install it from the university's website. The server certificate is cert 2, which is what the university's website presents to your browser at every visit. cert 1 is used to sign cert 2. When you connect to the university server through SSL, you will be presented with cert 2 and your ...


1

To answer your questions: I would imagine that either the router is just set up that way to be convenient, and so that you can contact help if the thing isn't working. That's my theory, I really have no idea why you would do such a thing. It sounds like a bad security practice to me, but also a purposeful choice. You really shouldn't be doing your bank ...


1

For proxying, it is possible to use Burp for android: https://systemoverlord.com/blog/2014/07/13/passing-android-traffic-through-burp/ (this second set of instruction assumes you are using an emulator) http://resources.infosecinstitute.com/android-application-penetration-testing-setting-certificate-installation-goatdroid-installation/


1

Alice sends hello to Bob which contains a code A. Eve intercepts the message and instead puts a code E. The above just won't happen. before Alice sends anything, Alice requests the CA to verify bob.com(Eve), the response from CA won't match Eve, so Alice will receive a warning saying that Bob's certificate is invalid. If somehow Alice has Eve's ...


1

You should not use this in any production system, period. You're trying to design cryptographic primitives, which is something which is extremely easy to get horribly wrong. If you aren't yourself a cryptographer, don't try to design cryptographic algorithms - perfectly good ones already exist. (In general, you should use well-tested systems wherever you can ...


1

HTTP protocol For HTTP this could be generalized to How does webserver hosting more websites knows which one to host? This is through technique called Virtual Hosting in which browser appends Host header to every request send and webserver serves the content of the wanted site, deciding via the header. So if I host foo.com and bar.com on the same ...


1

If the request to your domain is HTTPS (e.g. https://example.com) this is effectively immune to a MITM attacker (corporate proxy issues aside). If an attacker redirected example.com to the IP of their own site then their own site would not have a trusted certificate installed for example.com so the user would get browser warnings and would be strongly ...


1

The point of DH is that only the two parties can generate a shared secret (gxy) for the DH exchange. SKEYSEED is not the shared secret for the DH exchange. In fact its derived from the DH shared secret and the nonces; not from the transmitted DH parameters. SKEYSEED is never transmitted over the wire. Once the DH exchange is complete, and ...



Only top voted, non community-wiki answers of a minimum length are eligible