I go to a secondary school and want to use my Macbook Air to type out long essays. The school won't allow anyone to connect to the WiFi unless we download an SSL certificate (the file is labelled as WebScreenCert). I've researched it and this seems very vulnerable to attackers. However, since I don't live at the school, I don't necessarily need to do anything too private while on their WiFi. There's no reason why I should be entering my bank details, for example. If I just avoid doing anything too private while I'm at school, is the SSL certificate safe to download? Or can it give attackers access to my history or saved passwords, etc?
11
-
16There are two possibilities: 1) this certificate is used for MITM interception ; 2) this certificate is used only for authenticating to a authentication server for initiating the Wifi connection. You should try to see which king of certificate this is: Is this a CA certificate ? Is this a non-CA certificate associated with a name such as "radius.myschool.org", "wifi.myschool.org".– ysdxCommented Aug 27 at 15:47
-
24If you google WebScreenCert, you can see it's used to MITM (decrypt, examine content, re-encrypt)– coagmanoCommented Aug 28 at 5:15
-
18"I go to a secondary school and want to use my Macbook Air to type out long essays." You don't need internet for that, right?– ReznikCommented Aug 28 at 8:26
-
33Great question OP. I think sometimes with security issues a concise response is in order, and my response would be NEVER EVER DO THIS. It's a total PITA but, just accept that essentially "your school does not have wifi", however inconvenient that is.– FattieCommented Aug 28 at 11:38
-
12@Fattie "never" is a strange word to use when dealing with risk. This situation is neither strange nor unusual. And given the risk-mitigating measures the OP suggests, why make this such a hard line? What risks are there?– schroeder ♦Commented Aug 28 at 14:54
|
Show 6 more comments
7 Answers
⚠️ TLDR: You probably would not want to do that! This will install what is essentially a backdoor into your encrypted communications. (TLS interception) ☣️
There are several possibilities:
- This is a CA certificate used for TLS interception (MITM).
- This is a (non-CA) certificate of a authentication server and it is used only for communicating with this authentication server during the Wifi handshake (when using WPA-EAP/WPA-Entreprise using either of EAP-TLS, EAP-TTLS, PEAP, EAP-FAST, TEAP, etc.).
- This is a CA certificate which is used for communicating with the WPA-Enterprise authentication server.
- This is a CA certificate which is used for communicating with the WPA-Enterprise authentication server and for MITM introspection.
Note: In case (1), you will be able to connect to the Wifi network without installing the certificate but all (or most) websites will be blocked with a "untrusted certificate" error. In case (2), you cannot connect to the Wifi network at all and probably cannot even configure the connection to the Wifi network.
If we are in case (2), you are probably safe as long as the certificate is installed as a trusted server certificate and not as a CA certificate. (Although, the way this is handled probably depends on the operating system and I don't have much experience of macOS). Case (2) is a legitimate use case and as long as the certificate is not installed as a system-wide CA, but only for this Wifi connection, you should be fine.
According to the file name (WebScreenCert), I assume that we are in case (1). In the rest of this answer, I'm assuming we are in case (1).
Your school wants you to install a certificate associated to a private key they control in order to do MITM interception i.e. so that they might be able to:
- inspect all your TLS communications while you are using their network;
- filter/block some communications.
This technique is deployed in many organizations in order to:
- detect malwares in the network, block attacks;
- block abuse of the network (eg. leisure, watching series, illegal content, etc.);
- block NSFW content.
The immediate consequence is that the school administrators will be able to see everything (note: I am simplifying a little bit) you do on internet while you are using their network. If you are worried about this, you should probably avoid doing anything that you would not want them to see while you are using their network.
Even if you do this, you are not safe! A (malicious) actor which gets access to the private key (such as a malicious network administrator of your school or a hacker which would have hacked the school) might be able to:
- inspect your communications (eg. see the password you send to remote website, see the session cookie on all websites visited - which makes it possible to steal your sessions, see your emails, etc.) (for example, if you connect to a malicious Wifi network or a shared WPA-personal Wifi network);
- modify the data you receive from the internet (or send to internet);
- potentially attempt to use this to install malicious programs into your computer (by modifying the programs you download such as when you are updating your programs, unless all your software downloads/updates are signed).
If any of these worries you (it should!), you could use a separate browser profile (typically using Firefox) and configure the certificate only in this browser profile:
- While you are in your school network, you should use this browser profile and avoid doing anything suspicious.
- You should not login on any website using this browser profile on any website (unless you do not care if your account and password is stolen).
- You should not download any program using this browser profile.
- But you will not be able to use many other network-connected programs while you are using the school network.
- While you are not in your school network, you should use your main browser/browser profile.
Note: I am suggesting using Firefox because it uses a separate list of trusted CA certificates for each profile. As far as I known, all the other major browsers use a single user-wide/system-wide list of trusted CA certificates.
(TODO, I believe Firefox is using some digital signature when downloading updates so that the school certificate could not be exploited to install a malicious version of Firefox using the update mechanism.)
Another solution would be to:
- install a dedicated virtual machine;
- install the certificate system-wide in there only and only use this virtual machine when you are using your school network;
- do not do anything you do not want someone to see on this virtual machine;
- do not do login on any website/account you care about using this virtual machine.
-
10Good answer. I think from the name we can infer it's almost certainly (1) as you assume. BTW, I think Chrome certs are system-wide not per-profile so maybe strengthen "e.g. Firefox" to "only in Firefox"– paj28Commented Aug 27 at 15:51
-
7The cert name is WebScteenCdrt and WebScreen is a web filtering product– paj28Commented Aug 27 at 21:27
-
7Could the cert be both 1 and 2? If so, that seems relevant, because this answer as written seems to suggest that if it's option 2, then (a) it's easy to verify (the computer won't connect to the wifi without it) and (b) that it's safe from MITM. But if a cert can be both, then it could look like 1 while still acting like (and being subject to the same warnings as) 2.– yshavitCommented Aug 28 at 1:40
-
4Yet another option: do not use the school WiFi to connect to the internet (OP may still have to use it for the school intranet).– gerritCommented Aug 28 at 6:47
-
10A very important detail that this answer is overlooking is that the wifi connection may not belong to the school at all. Do not trust that this came from your school unless your school has provided you with actual documentation explaining this process in your orientation paperwork. Commented Aug 28 at 17:04
Welcome to SE! I'm not competent to explain all the risks here, but one solution might be to install their certificate only in one browser like Firefox. If you already use Firefox, you can create a completely separate profile and install it there. This allows you to keep your under surveillance school browsing totally sandboxed and away from your regular browser, online banking, etc.
Instructions from here:
- On the Firefox menu, select Preferences.
- Click Privacy & Security.
- Scroll down to the Security section and click View Certificates.
- On the tab Your Cerficates, select Import.
- Browse to the P12 file to import and enter the password used when the file was requested.
- On the Mozilla Firefox tab Your Cerficates, ensure that the certificate was imported correctly.
- Click OK and restart your browser.
-
3"If you already use Firefox" would be a very good reason to not install anything shady in Firefox, even if it's in another profile. I keep Chromium specifically for those kind of weird requirements, and only those. Commented Aug 28 at 13:49
-
4I would go with a portable version of FF, not only a profile. Even with a separate profile in the machine-installed browser, some fingerprint data may leak because the plugins, fonts, etc... are all the same. Commented Aug 29 at 14:28
One thing you never address in your question/answer to comments is:
Where this SSL certificate comes from.
There are 2 possibilities that I see.
- You got this from your schools It department.
If that is the case, its probably safe to use (if you trust your school) though it is a bit odd that they would do this.
- The "school" wifi told you that you need to download their this SSL certificate for "security".
This sounds a lot like something I might do. Put a router in a spot where a lot people tend to gather and have it strong enough to override the school's wifi with my wifi that has the same name. I might even connect it to the school's internet.
Then provide a fake SSL certificate and tell students they need to download it so that I can fake google. Gmail access lets me reset bank passwords/a lot of people use gmail for 2FA as well. It's stupid, and why I don't think much of 2FA. On the otherhand this is a school, so its possible someone is trying to steal professors passwords/usernames.
All in all given its not a bad plan. This kind of attack is extremely simple to pull off if your school doesn't scan for it.
Edit: Realized I didn't give actionable advice on what to do. I am going to assume that it is the WIFI that told you to download the SSL certificate. In which case as Nosajimiki suggested in a comment. Report this to your school's IT department. Someone is stealing passwords/usernames.
-
1Agreed, this sounds like an Evil-Twin Network attack. I would add to this answer that the first step the OP should take when they find a suspicious public network like this is to report it to the organization's IT department so that they can investigate and take down the evil twin and let everyone at the school know about the breach so they can reset passwords, etc. That way you are not just protecting yourself, but everyone else in your school who may not know to question it. Commented Aug 28 at 16:56
-
That's a good point, My answer was focused on explaining what I thought the SSL certificate was/the purpose behind it, instead of what actions OP should take in response. I am going to add your suggestion of reporting it to the schools IT department into my answer– QuestorCommented Aug 28 at 18:16
-
1it was sent by a school administrator to the whole school and we were told about it in assembly, so don't worry, it's definitely approved by the school! I'm just concerned they haven't thought through all of the implications. Commented Aug 30 at 10:19
-
@GraceMcCarthy In that case, it really comes down to a balance between how much you trust the school vs how worried you are about the browsing you are doing. It's only a risk if (1) some other WiFi that you connect to gets hold of that cert AND the key; (2) You are doing something dodgy on that link, that the school IT admin gets hold of. The main point of this cert is actually to keep you safe, by allowing the school to filter your connection, to block anything deemed 'unsafe' or 'unacceptable'.– MikeBCommented Aug 30 at 13:38
-
If you install the malicious certificate, all network access from your device is backdoored, even when connected to a non-school wifi network. You should not do this unless you have absolutely no other choice, and in that case, you have to be aware that you can no longer do anything private from the backdoored device.
If you need to access the school wifi, the simplest thing you can do is setup your browser to let you individually click-through forged-certificate warnings for whatever you need to access, but never access any sites (such as social media, your Google account, etc) you don't want to have the school steal your access credentials for.
Better options would be to use tethering on a phone (it can even be turned on silent mode and hidden in a backpack if you're not allowed to have it out during the day), or to get a trustworthy VPN and tunnel out through it over the school wifi.
answered Aug 28 at 20:44
R.. GitHub STOP HELPING ICER.. GitHub STOP HELPING ICE
8,5741 gold badge26 silver badges36 bronze badges
-
1
-
2If you trust the root certificate of a malicious actor, only those connections where that exact attacker is able to perform a man-in-the-middle attack, by physically inserting themselves into the connection between you and your target server, are affected. "All network access from your device is backdoored" is a wild exaggeration and has no technical basis. Commented Aug 29 at 9:37
-
1@Questor many, many secondary school campuses around the world do this. This falls under "duty of care". Not malicious at all.– schroeder ♦Commented Aug 29 at 16:09
-
1There absolutely does not need to be any further intent to do something nefarious with the information intercepted for it to be malicious. Just the act of undermining privacy of the communication is in itself already malicious. If you disagree with this, you just have a fundamental difference of values incompatible with the school of infosec to which I and the other folks here belong, and that's more in line with the cop school of infosec... >_< Commented Aug 30 at 15:15
-
1@jrw32982: The feeling that I can't trust my private communications aren't being intercepted by someone is already a concrete harm, even if nobody ever bothers to intercept them. The breaking of certificate trust is not just allowing harmful behavior. It is a harmful behavior. Commented Sep 4 at 1:12
Many answers here explain that MITM interception is evil, because the network admin is able to see any SSL encrypted exchange (essentially HTTPS) in plain text. That is true, but we should be aware that in some countries (including West European ones), if a corporate network is used for criminal operations (access to pedo-pornography, arms or narcotics trade, etc.) and if the network admin had taken no special measures to avoid it, they could be facing legal proceedings.
That means that if the school opens a free WiFi without any control, and if it is used for criminal operations, the school principal could be in trouble.
The common rule for such MITM interceptions, is that they produce logs that no admin may consult, unless either they have evidences of uncommon usage, of they receive a legal request. What I mean here, is that unless you intend to use the school netword for illegal actions, you should not worry too much for that: admin do have enough tasks not to waste time looking at what you have done... provided it is a genuine usage.
As you are aware of it, the best to do IMHO is to limit WiFi usage at school to only browse on safe sites - and of course never send truely private data like credentials.
answered Aug 29 at 12:50
-
2Keep in mind that even if admin is honest, these logs are going to be stored somewhere. If that storage is not secure enough (and secondary schools usually don't employ security experts), this might make stealing your sensitive data easier for a third party.– bebidekCommented Aug 29 at 16:36
-
@bebidek: My last sentence was about not using that network for sensitive data... The rule is that the usage shall be in par with the trustness.... Commented Aug 29 at 17:03
-
@bebidek The chance of anything sensitive being stored in those logs is infinitesimally small. A 'standard' log isn't going to log anything more 'intimate' than the URL being requested.– MikeBCommented Aug 30 at 13:44
-
I have a better idea: Don't decrypt my goddamn data, unless the admins are also accountable to ME.– chiggsyCommented Aug 30 at 19:32
-
@chiggsy: if you own the network you can do what you want on it. If you want to use someone's else network, you have to observe the network owner's rules... or not use it. Commented Aug 30 at 20:53
Somewhat off-topic, but another way schools/employers may try to monitor you is by insisting you install MDM software on your device, such as InTune of Jamf. These programs are essentially backdoors, even more powerful than SSL certs. While acceptable (I guess) on org-issued devices, you should absolutely never install such software on your personal device.
-
As it’s currently written, your answer is unclear. Please edit to add additional details that will help others understand how this addresses the question asked. You can find more information on how to write good answers in the help center.– Community BotCommented Aug 29 at 21:30
WebScreen is a highly flexible web filtering system designed and built for the UK education sector, fulfilling the requirement of the Department for Education’s statutory safeguarding guidance ‘Keeping Children Safe in Education’ to offer 'appropriate filtering'. Its user manual is online at https://webscreen.lgfl.org.uk/UserManual/index.html
This system is capable of decrypting your 'https' traffic for monitoring and filtering purposes. The system administrators can be seen as attackers of your privacy. They'll be in the middle of you and your internet traffic, they can journal your use, they cannot see the browsers' history. They'll see the passwords once you use them, not your password store.
Using the certificate only in Firefox, not system-wide, is recommended.
