Hot answers tagged

188

Don't install their certificate on any device/OS installation which you ever want to use for private activity. Once you do, your traffic is subject to MITM attacks even if you are not using your college's network. Such an attack requires having the private key for the certificate you installed, but in practice this is quite easy because these "security ...


107

A VPN is certainly a good solution, provided they don't block that, too. The best solution for protecting your privacy, though, is probably to try your hardest to get this policy overturned. This is an absolutely abhorrent 'security' policy. It's literally a built-in man-in-the-middle attack against everyone on campus. If their firewall becomes compromised, ...


67

Your college is providing the "network connection" service under some conditions, one of them being the ability for the college system administrators to inspect all the traffic. While it is tempting to defeat the nosiness of such sysadmins with some technical gimmick (e.g. a VPN, as was suggested in another answer), this would be an explicit attempt at ...


54

Don't use their network for anything personal. That's the best way to protect your privacy from them. If you don't have any choice, then use a Virtual Machine, and install the certificate on the virtual machine instead of your main machine. It may allow you to protect your privacy. Personally, I always used a separate computer for these kind of issues. ...


37

If ssh is not filtered out, then you can use ssh to produce a SOCKS proxy running over an ssh tunnel. You need not install any software to make this work. You do not need VPN software. The following will will work on a Linux machine or a Mac (and can probably be able to be made to work on Windows): Get a shell account (or a VM, but that's over the top) ...


30

You should watch Moxie Marlinspike's talk Defeating SSL using SSLStrip. In short SSLStrip is a type of MITM attack that forces a victim's browser into communicating with an adversary in plain-text over HTTP, and the adversary proxies the modified content from an HTTPS server. To do this, SSLStrip is "stripping" https:// URLs and turning them into http:// ...


16

Here are my recommendations for what users can to defend themselves against SSLstrip, Firesheep, and similar attacks: Install HTTPS Everywhere or ForceTLS. (HTTPS Everywhere is easier to use.) This tells your browser to use the SSL versions of web sites, where possible. If the browser gives you a certificate warning, do not bypass the warning, and do not ...


13

Read the T&C's. See if you are allowed to use a VPN (some protocols may be forbidden, VPNs may be too). If you are, then use a VPN, and never connect to any site directly through their network. (Unless you are using certificate pinning, but then the connection is likely to fail because the certificate won't match). Precise routing tables can help you ...


12

Since you're doing a 301 redirect over HTTP, someone could man-in-the-middle that connection and redirect you anywhere they wanted - in particular they could actually not redirect you at all, and instead get between your computer and https://login.example.com, monitoring your connection and serving you its contents under the name http://login.example.com ...


8

IIRC, SSLStrip does not do a traditional SSL-MITM attack. What it does is watch HTTP traffic, look for links and redirects to HTTPS traffic, and rewrite those links/redirects to HTTP. A quick look at their website confirms this. So, you must have some non-ssl page which links/redirects to an ssl page. SSLStrip sees that and changes the link/redirect to a ...


8

There is no new version of sslstrip since 2011 and the feature is already there. How It works: First you need to know about the HSTS headers. SSLStrip will work when server sends HSTS header for the first time and you intercept the traffic in between don't allow the header to reach to the client. The important header field of HSTS that allows client to ...


8

is forcing us to install Cyberoam Firewall SSL certificate so that they can view all the encrypted traffic to "improve our security". Malware is sent over HTTPS too, so it probably is really their intention to improve the security by analyzing encrypted traffic for malware. If they just want to block access to some sites they could probably do it ...


8

Don't use the network. That's pretty much your only option. Any attempt at circumventing their "security" measures would most likely be considered "unauthorized access" under the CFAA (assuming US jurisdiction) and could result in many many years of prison time. You could try taking them to court, but your chances are pretty slim. Public and private ...


7

SSL 2.0 is not a vulnerability; it is a protocol which happens to contain structural vulnerabilities, and, as such, should not be allowed. There is a RFC which says just that, and lists the main known deficiencies in SSL 2.0: SSL version 2.0 [SSL2] deficiencies include the following: o Message authentication uses MD5 [MD5]. Most security-aware users ...


7

Yes, without further measures, the attacker still can perform SSLStrip. For SSLStrip to work, the attacker only needs to be a man in the middle, unrelated from your behaviour regarding HTTP. On an incoming HTTP request, the attacker would open an HTTPS connection to the real server, and "strip" the SSL off the HTTPS. So, there would be no HTTP communication ...


6

sslstrip: This is a downgrade attack, i.e. browser is forced to use insecure HTTP instead of HTTPS. It is still possible, but can be mitigated by the server with HSTS, at least for supported browsers. Most current browsers support it, see caniuse.com for more details. sslsniff: This is a man-in-the-middle attack. The browsers detected this already 4 years ...


5

Google Chrome browser uses preloaded HSTS list. Firefox 17 (most recent release) also added support for the list. It is the same list that Google Chrome uses. HSTS, along with having HTTPS only website are best mitigations against such an attack. Your HTTP website should only permanently redirect to HTTPS and not provide any content.


5

How would they be able to verify whether or not you had/had not installed their SSL certificate? Are they also running software on your local machine? Otherwise I would think the adverse effects would just be you having to deal with a lot of certificate errors on your end. What I'd do if I were you is either dual-boot or virtualize. Have your unsafe OS ...


5

Short answer: Yes, for resonable defintions of safe. HSTS protects you against sslstrip type attacks for sites you have visited recently using a non-compromised connection (or for some browsers sites that are stored in a hardcoded "preload list"). The regular SSL CA system protects you against MITM attacks of ssl connections where the attacker has not ...


4

SSLStrip will work on any browser. This attack will fail to work under Firefox and Chrome for websites protected with HSTS. For example Google.com and gmail.com should not be affected by SSLStrip because of HSTS. Internet Explorer is not complaint with RFC-6797, which describes the HSTS security measure and is therefore more susceptible to attacks like ...


4

Checking correct usage of HTTPS is ultimately the sole responsibility of the user. The users need to look at at least 3 points when visiting a web-page: Are they expecting HTTPS to be used (at least for this part of the site)? If so, is the certificate valid (lock/green/blue bar, without warning)? If so, is the host name in the address bar that of the site ...


4

If you're talking about Moxie's "sslstrip" attack, it's more of a user-oriented attack than an actual technical attack on SSL. It doesn't break the underlying cryptography or trust model. (He has another tool, sslsniff, which actually does attack some of the technical implementations of trust and certificate checking.) First of all, you should watch his ...


4

No, that is not possible. In case the user types 'https://', the secure tunnel is generated, and SSLStrip cannot interfere anymore. SSLStrip works by intercepting HTTPS redirects sent from the server. SSLstrip then sets up a HTTPS connection with the server (the server thus thinks everything is ok), but keeps an HTTP connection with the victim. SSLStrip ...


4

This is answered going off the available information you linked to. How exactly is the victim being redirected. Does the DNS packet contain some sort of redirect? Or is it something else that redirects the user to wwww.google.com? When the user navigates to www.google.com, sslstrip acting as a MITM will redirect the user to wwww.google.com using ...


4

If I am not mistaken, importing your own SSL certificates is just for the connections which you make to the device's own web interface so that won't help you to accomplish your goal. What you would need to do is: Create your own root CA Make those devices trust your own root certificate Redirect all SSL traffic from those devices to your proxy When a ...


4

Pick a softer target. Facebook is on the Chromium HSTS preload list Twitter is on the Chromium HSTS preload list Update 1 So: Pick a target that doesn't use HSTS and/or pick a browser that doesn't care about HSTS.


4

[Disclaimer: I'm one of the mitmproxy authors. My opinions may be biased. :)] sslsplit sslsplit is a transparent proxy that can intercept TLS connections using a man-in-the-middle attack. sslsplit supports plain TCP, TLS and also HTTP to the extent that it removes HPKP, HSTS and Alternate Protocol response headers. Intercepted connections can be dumped ...


3

You can also use NoScript to ensure your connections are over https. NoScript also comes with a tonne of other defences that include XSS protection, Clickjacking detection, ABE (kinda like a firewall in your browser) and many more. NoScript has been around for years and it's highly regarded and respected.



Only top voted, non community-wiki answers of a minimum length are eligible