In order to decrypt HTTPS you need the public key and the private key. How can a hacker acquire the private key?
What exactly does he have to do to get it? I read that they use packet sniffers like Wireshark to decrypt HTTPS, is this true?
I also read somewhere that the hacker needs to have physical access of your device (computer, smartphone) to get the private key.
So if your router gets hacked is decryption of https possible and can the complete url of sites that you visit be viewed?
So if your router gets hacked is decryption of https possible and can the complete url of sites that you visit be viewed?
In order to decrypt HTTPS one must first be some man in the middle to get access to the traffic and second have the private key for the server in question. With the server doing DH key exchange (most servers today, since RSA key exchange is obsolete) one must also be able to modify the traffic and claim the identity of the server, i.e. active man in the middle and not only one passively sniffing.
Hacking the router might provide the ability to sniff and modify the traffic. But the private key of some server on the internet is private to this server. There is no access to this key on the router or on the client since it gets never transmitted - all what the server does is prove that it owns the key by signing some challenge. Thus neither (in case of RSA key exchange) passive sniffing and decryption of the HTTPS traffic from arbitrary servers on the router will work, nor active interception (required in most cases) with claiming the server identity.
Note that this is different if the router is not just a dumb router forwarding traffic, but an actual security device which is explicitly trusted by the clients to do TLS man in the middle. In this case hacking such a "router" (or better called "firewall" or "corporate proxy") will give the hacker also access to the decrypted traffic, since decrypting the traffic for introspection is an explicit feature of the device. See also How does SSL Proxy server in company work?.
Note that in an https connection, the client does not have a private key - only the server does.
Having said that, there are many ways that an adversary can view and/or modify your network connection. For example:
However, being in a position to view and/or modify your network connection is only half the battle. If you connect to sites by https, then being in a position to view and/or modify your network connection is of little good to the attacker, unless:
The attacker has the private key of the server. In this case, the attacker would be able to use the server's certificate and the private key to impersonate the server. See this question for more info.
The attacker dupes you into trusting a fake certificate for the site, and mounts an MITM attack. See this Wikipedia article for more information.
A hacker cannot decrypt your TLS traffic by hacking your router. The key is generated by the server on the TLS transaction, and it will never be transmitted anywhere.
I read that they use packet sniffers like Wireshark to decrypt HTTPS, is this true?
Yes, but only if they get the symmetric key first. To get that, you need to instruct your TLS client to write the TLS key somewhere, and you load that key on Wireshark. Unless you do so, Wireshark cannot decrypt anything.
the hacker needs to have physical access of your device(computer, smartphone...) to get the private key
Law #3 of Security: If a bad guy has unrestricted physical access to your computer, it’s not your computer anymore.
If anyone have physical access, they don't need to get your keys. They can just alter any software you have to send them the traffic before the encryption. No need to hack your router.
So if your router gets hacked is decryption of HTTPS possible and can the complete URL of sites that you visit be viewed?
No and no. The hacker can know the domain you are accessing (because of the SNI). Encrypted SNI could protect even the domain name, but it's not still in widespread use.
You don't need RSA key pair on your side to securely communicate via HTTPS. Browser agrees with the server about keys for the current session. See details here. At one of steps the server sends to the browser data signed by its key. The browser validates the signature and knows for sure that the data really come from the expected server and that these data were not modified.
If the attacker reads your traffic e.g. with Wireshark, this will not harm, because Diffie-Hellman key exchange does not reveal secrets.
If the attacker attempts to manipulate the traffic, e.g. using your compromised router, the browser will report the server signature as invalid and will refuse to establish connection.
As long as your device is not compromised, and if the server supports TLS 1.3, a compromised router will not allow to read your HTTPS traffic.
If your device is compromised, then of course you cannot be sure: An attacker can install forged CA certificates and use it for a man-in-the-middle attack, or your browser can be infected with a malicious code so that your traffic will be known to the attacker, and so on.
