227

My college administration is forcing us to install Cyberoam Firewall SSL certificate so that they can view all the encrypted traffic to "improve our security". If I don't install the certificate than I won't be able to use their network.

What are the ways I can protect my privacy in such a situation? Will using a VPN be enough to hide all my traffic or there are other ways?

  • 8
    Comments are not for extended discussion; this conversation has been moved to chat. – schroeder Nov 5 '15 at 5:11
  • 5
    Again, comments aren't for chat. I have removed all comments posted since the original migration to chat. Please go to the chat and comment there for discussion. – Jeff Ferland Nov 5 '15 at 19:41
  • 5
    An easy way to not compromise your computer, use the compromised network and not a lot of effort (like installing a VM): Install an individual Browser which uses its own certificate store (not the system store) and install the certificate only in that browser. User that browser only for work in the compromised network, not anything private or any software downloads. – Falco Nov 9 '15 at 11:43
  • 3
    If you do install their cert (e.g., in a VM), and if you use Firefox, I recommend you set security.cert_pinning.enforcement_level in about:config to 2 (strict). This will prevent them from bypassing public key pinning (i.e., prevent them from MITMing sites that have established a public-key pin). See Mozilla bug 1168603 for explanation why. – D.W. Nov 13 '15 at 0:19
  • 3
    which college do you attend? – ŹV - Nov 14 '15 at 22:58

14 Answers 14

219

Don't install their certificate on any device/OS installation which you ever want to use for private activity. Once you do, your traffic is subject to MITM attacks even if you are not using your college's network. Such an attack requires having the private key for the certificate you installed, but in practice this is quite easy because these "security products" are so badly designed, and often use either very weak key generation or use a fixed private key that's the same for all deployments and available to any of their customers. In a comment that's since been moved to chat, TOOGAM wrote:

Specific problem known about this specific vendor's certificate "It is therefore possible to intercept traffic from any victim of a Cyberoam device with any other Cyberoam device - or to extract the key from the device and import it into other DPI devices"

If you don't need resources on their network, just use wifi tethering on your phone or get a dedicated 3G USB dongle or similar for use when you're on campus. Alternatively, if non-HTTP traffic is not subject to the MITM, you may be able to use a VPN without installing the certificate. In this case, just get a cheap VPN provider or VPN to your home network if you have one.

If you do need access to resources that are only available from the campus network, install another OS in a virtual machine with the MITM CA installed only in the VM, and use the browser in the VM for accessing these resources.

  • Comments are not for extended discussion; this conversation has been moved to chat. – Rory Alsop Nov 12 '15 at 20:17
  • 1
    Is the ability for the college to monitor the communications (on devices with the certificate installed) something specific to this SSL certificate, or something that all certificate providers can do? E.g. Eduroam that is provided by many colleges? – Winterflags Nov 14 '15 at 18:40
  • 3
    @Winterflags: Any time you install a custom CA certificate, you're telling your browser/system to accept certificates signed by that CA as if they were signed by one of the "real" CAs that are trusted by default. Anyone with the private key for the custom CA can issue forged certificates for any site and your browser will accept them just like it would the real certificates. – R.. Nov 14 '15 at 23:37
  • 1
    As far as I can tell, Eduroam has nothing to do with custom CA certs but rather (as one option) uses client certificates as an authentication method. However if you're concerned it would be a good idea to open a new question about what Eduroam does rather than discussing it in the comments on this question. – R.. Nov 14 '15 at 23:38
136

A VPN is certainly a good solution, provided they don't block that, too.

The best solution for protecting your privacy, though, is probably to try your hardest to get this policy overturned. This is an absolutely abhorrent 'security' policy. It's literally a built-in man-in-the-middle attack against everyone on campus. If their firewall becomes compromised, the attacker can then intercept anything anyone on campus has sent over the Internet, including passwords, credit card numbers, etc.

It turns out that these devices are even worse than they first sounded. As TOOGAM pointed out in a comment, the people at the Tor Project found that, at least as of 2012, all of these devices used the same CA certificate! This means that anyone with access to one of these deep packet inspection devices from Cyberoam or a CA certificate exported from one of them can intercept traffic from anyone who has that root CA certificate installed. Even if this has been remedied in the past 3 years, this casts extreme doubt on the competence of the makers of this device to secure it. This is all the more reason that you should definitely not install this certificate and you should raise as much support for the removal of this device from your campus as you possibly can.

Furthermore, as has been pointed out in comments that have since been cleaned up, use of this device violates the Terms of Service of almost every website on the planet because it discloses your login credentials to a third party (the college.) This means you cannot legally abide by both this policy and the ToS of almost any website.

If this were a public college in the U.S. and they didn't remove this device immediately, for a security hole of this magnitude I would strongly consider contacting my local FBI Cyber Task Force, who should be willing to give the college a very stern talking to. They take this sort of thing very seriously and for good reason.

  • 13
    +1 for "if their firewall becomes compromised, the attacker can then intercept anything anyone on campus has sent over the Internet"! This college really needs to change what they are doing! – Numeri Nov 5 '15 at 14:16
  • 69
    TIL you can get the FBI involved in these situations. +1 for that. – Blacklight Shining Nov 5 '15 at 22:53
  • 15
    @whatsisname True, but the FBI special agents I've talked to in the CTF here actually take large security holes at large institutions (both public and private) rather seriously, as they (rightly, IMO) consider them to be a serious threat to national security. A lot of APTs use compromised domestic systems to stage their more sophisticated attacks, as these will usually be given less scrutiny by intrusion detection systems, especially if the compromised system belongs to a large, reputable organization. – reirab Nov 6 '15 at 5:52
  • 7
    @JonBentley: They do not "have every reason to presume is secure"; in fact, quite the opposite. They are explicitly installing a backdoor that somebody else has instructed them to install. – R.. Nov 8 '15 at 1:35
  • 5
    @JonBentley I'd assume that the college at least made it clear that they were spying on the encrypted traffic. If they didn't make that clear, then a reasonable expectation of privacy would likely exist, which opens up a whole new can of worms for the college in terms of legal liability (at least civil and perhaps criminal.) I'll try to edit in some TOS excerpts tomorrow. For a quick example, though, StackExchange's own TOS states that the user shall indemnify StackExchange for any liability arising from the user or anyone else using their account. – reirab Nov 8 '15 at 8:11
74

Your college is providing the "network connection" service under some conditions, one of them being the ability for the college system administrators to inspect all the traffic. While it is tempting to defeat the nosiness of such sysadmins with some technical gimmick (e.g. a VPN, as was suggested in another answer), this would be an explicit attempt at defeating the "security systems" of the college network and this can land you in a huge heap of trouble. The wisest course of action would then not to do that, and instead use your own Internet (e.g. through your personal phone).

  • Comments are not for extended discussion; this conversation has been moved to chat. – Rory Alsop Nov 4 '15 at 19:01
  • 1
    @PaulDraper "workaround" would be a synonym here. – djechlin Nov 6 '15 at 6:49
  • 6
    Unless the conditions prohibit the use of a VPN then you probably aren't breaking them. The security systems are probably there so that if law enforcement want to know who is visiting a specific page or site then they can be located. If you were going over a VPN then law enforcement wouldn't end up at the University connection, but instead wherever your VPN terminates, meaning the University wouldn't have to do anything. – Matthew Steeples Nov 9 '15 at 11:44
  • 1
    @immibis The VPN provider wouldn't need to though. If law enforcement goes to a VPN provider and asks who was using this IP address, then they already have the user's details because they'll have used a username and a password. They won't deflect the responsibility of identifying the person to someone else. Chances are if law enforcement are chasing you for something, being in breach of the university regulations is low down your list of worries! – Matthew Steeples Nov 11 '15 at 10:05
  • 1
    @immibis True, but I'm working on the assumption that the VPN provider is not free, so therefore knows more about you than just your username. Granted you could have used stolen card details, prepay credit card or whatever else, but I'm not approaching this from the point of view of how to get away with something, merely illustrating that the university may just be doing this to cover their own backsides – Matthew Steeples Nov 12 '15 at 22:30
61

Don't use their network for anything personal. That's the best way to protect your privacy from them.

If you don't have any choice, then use a Virtual Machine, and install the certificate on the virtual machine instead of your main machine. It may allow you to protect your privacy.

Personally, I always used a separate computer for these kind of issues. No way would I allow a company/educational institution install anything on my own equipment, unless I planned on nuking it from orbit later.

  • 6
    +1, though "Don't use their network at all to the maximum extent you can avoid it" might be even better advice. – reirab Nov 4 '15 at 16:44
  • 73
    This is bad advice. Once you've installed the certificate, you're vulnerable even when not using their network. Most of these MITM products use the same private key everywhere, or weak key generation, meaning an attacker on any third-party network you connect to could equally be MITM'ing you using the fact that your browser trusts the malicious CA cert from your college. – R.. Nov 4 '15 at 17:11
  • 21
    This isn't really feasible for students who live on campus. – Michelle Nov 4 '15 at 17:13
  • 8
    Use an ssh-based VPN and connect the first time from some other network and establish a key auth. They can't breach that. – Joshua Nov 4 '15 at 20:00
  • 13
    +1 million for the Virtual Machine idea. Install the cert there, use it only for schoolwork, and never! do anything sensitive inside it. You might also (not instead) do the same trick for sensitive activity (like banking) - have a VM just for secure things, and only boot it up off-campus and with a VPN. – willoller Nov 4 '15 at 22:30
44

If ssh is not filtered out, then you can use ssh to produce a SOCKS proxy running over an ssh tunnel. You need not install any software to make this work. You do not need VPN software. The following will will work on a Linux machine or a Mac (and can probably be able to be made to work on Windows):

  • Get a shell account (or a VM, but that's over the top) somewhere

  • Check you can log into it with ssh from outside your institution and accept the host key (outside the institution to ensure they aren't MTiM'ing ssh - unlikely)

  • In a terminal ssh -D 8080 -N username@host.name.here (note this will appear to hang)

  • Now use 127.0.0.1:8080 as your SOCKS proxy

Once this works, you can (optionally) use autossh in place of ssh and it will keep the tunnel up - you will probably need to install that.

Untested Windows instructions (requiring download of PuTTY) here.

The reason why this works is that your HTTPS traffic no longer flows over port 443. It flows (re-encrypted) over port 22. By assumption, they aren't intercepting the ssh protocol. And if they are, you can tell. Your traffic looks like ssh traffic (because it is ssh traffic) - though detailed traffic analysis might suggest it is ssh traffic carrying proxied web requests. It thus is not immediately identifiable as VPN traffic. Moreover, your college is likely not to block ssh traffic as it will be used by CS students.

An alternate route would be to tether to your cell phone and use a data plan.

  • I would change the command to be ssh -f -D 8080 -N username@host.example.com. The -f will put it in the background such that the command will not appear to hang. – kasperd Nov 5 '15 at 22:38
  • "By assumption, they aren't intercepting the ssh protocol. And if they are, you can tell." - could you explain how you can tell if they are doing a MiTM on the ssh traffic? – Floris Nov 9 '15 at 21:36
  • 7
    @Floris it is entirely possible to know if they are intercepting SSH, but you have to know the fingerprint of the server's key before trying to connect through the compromised network. This is called "trust on first use," and SSH saves the fingerprint of the key it sees the first time it connects to a server (this can be disabled, of course). On subsequent connections, if the fingerprint changes, it prints a very nasty notice. – thirtythreeforty Nov 9 '15 at 22:26
  • 1
    @thirtythreeforty ah yes - I have seen that notice... Definitely makes you sit up and pay attention. So the trick is to make this connection first when there is no possibility of a MiTM attack, and then not blindly dismiss warnings. Thanks for the clarification! – Floris Nov 9 '15 at 23:04
17

Read the T&C's.

See if you are allowed to use a VPN (some protocols may be forbidden, VPNs may be too).

If you are, then use a VPN, and never connect to any site directly through their network. (Unless you are using certificate pinning, but then the connection is likely to fail because the certificate won't match). Precise routing tables can help you with that. You may not even have to install the certificate (you may need it to install the certificate to log into something when connecting to the network, though).

If you are not allowed to, well...

  • Don't install the certificate on any computer you use for personal stuff. Use a different machine or a VM. Never do anything personnal on that computer/VM.
  • Talk about this with fellow students. Raise awareness on this issue around you.
  • Take the matter to whichever authority has competence. May be ask on http://law.stackexchange.com for advice on whether you can protest against this.

Don't do anything against the T&Cs, that's the best way to be simply banned from the network, or worse.

12

Don't use the network.

That's pretty much your only option. Any attempt at circumventing their "security" measures would most likely be considered "unauthorized access" under the CFAA (assuming US jurisdiction) and could result in many many years of prison time.

You could try taking them to court, but your chances are pretty slim. Public and private institutions have been doing this sort of network monitoring and interception for many years without running afoul of the law.

10

is forcing us to install Cyberoam Firewall SSL certificate so that they can view all the encrypted traffic to "improve our security".

Malware is sent over HTTPS too, so it probably is really their intention to improve the security by analyzing encrypted traffic for malware. If they just want to block access to some sites they could probably do it without SSL interception.

SSL interception is very common in companies for exact the same reason, i.e. to protect the company against malware.

Will using a VPN be enough to hide all my traffic or there are other ways?

That depends on their network configuration. If they are smart enough the will block the usage of VPN etc. And I would imagine that they explicitly forbid bypassing the firewall using such technologies, because this means bypassing the protection and making the network less secure. Thus expect to loose the network connection if you use a VPN.

If I don't install the certificate than I won't be able to use their network.

If you own the network there are enough ways to attack the computer or invade the privacy of the users, even without the use of SSL interception. If you don't trust them don't use their network, no matter if they use SSL interception or not.

  • 1
    Not only is malware sent over HTTPS, some of it will use SSL to phone home. – Iszi Nov 4 '15 at 17:48
  • 3
    Unless the university is also providing the computers, comparing this to what a company does to their own equipment is an apples to oranges comparison - unless you have examples of a company installing a cert on a personal computer? – user2813274 Nov 4 '15 at 23:05
  • 6
    I think it's more likely that they are using content filters to stop "forbidden" content like pirated movies, music and software than stopping malware. If they wanted to stop malware, they could just offer free anti-virus that will help protect users even when they are not on the college network. – Johnny Nov 5 '15 at 0:34
  • 1
    @user2813274 Chances are the university does provide computers, but also allows students to use their personal devices (as a "bonus feature" that it's not necessary for them to provide). In this case, if the asker does not want the university network's policies to apply to his/her personal device, he/she should simply not connect his/her personal device to the university network, and use the provided computers instead. – immibis Nov 5 '15 at 4:02
  • @Johnny: filtering which hosts can be accessed can often already be done without SSL interception. And the is a huge difference between offering a free anti-virus and making sure that everybody is using it. Apart from that lots of today's anti-virus come with their own SSL interception. – Steffen Ullrich Nov 5 '15 at 5:24
5

How would they be able to verify whether or not you had/had not installed their SSL certificate? Are they also running software on your local machine? Otherwise I would think the adverse effects would just be you having to deal with a lot of certificate errors on your end.

What I'd do if I were you is either dual-boot or virtualize. Have your unsafe OS where you install all their "security tools" and certificates and (and don't use anything you don't want someone to see), and then when you want privacy, move back over to your secure OS. If you live on campus and will pretty much always be using their network, then just have your secure OS use a VPN by default, which should skirt their requirements. There are ways they can notice that, but you can always tell them you have a job or something and need it for work, and they might believe you and leave you alone.

Alternatively I'd say get an cellular hotspot. But I know that when I was in college I couldn't afford the kind of data plan that would need.

  • 6
    If it works the same way as the bluecoat monitoring system my employer uses; without their cert installed you won't be able to access any HTTPS sites that aren't white listed. It's been long enough since the last time I had to load a new cert that I don't remember if the failure mode was BC blocking the outbound request, or intercepting the handshake MITMing it and returning a result protected by the BC cert instead of the sites normal cert and triggering the invalid cert error in the browser. – Dan Neely Nov 4 '15 at 16:57
  • 1
    " the adverse effects would just be you having to deal with a lot of certificate errors on your end." - well yeah, you'd run into a certificate error for every single website, and bypassing the certificate errors has the same effect as installing the certificate. – immibis Nov 5 '15 at 0:47
  • 1
    Cert errors are the minimum hassle. If they configure the equipment to block all non-compliant SSL, then no SSL sites will work. If they go even further and require all web traffic to proxy via SSL, then potentially all web traffic could be blocked. Basically, if you want to use their gateway, you're going to have to follow their rules. – GuitarPicker Nov 5 '15 at 19:40
3

Proposed solution: Use a virtual machine with the Certificate installed when you want to use their network. This way it will be very clear to you when you are using their network and when you are not. You can also discard the VM when you no longer need to use their network.

  • 1
    This doesn't protect him/her from having his e-mail password sniffed, or his bank details, or his private conversations, or, or, or... – J.J Nov 4 '15 at 20:23
  • 1
    @J.J - That is true, however it prevents him from accidentally accessing his email/bank/privateInfo while connected to their network. It is a very clear UX trigger that will remind the user not to access private data. – sixtyfootersdude Nov 5 '15 at 19:45
1

You can use their certificate, and use a VPN on top of that.

You can create a custom routing table, routing everything but the internal network traffic through the VPN. This way they can only decrypt the connections between you and the systems on the college network. Everything else will be routed via your VPN connection, and will be safe.

But using a VPN will make all your traffic be directed for a single server (your VPN provider), and will surely look very suspicious on the logs. If your college does not allow VPN connections, it's best not use one, or use it only for specific tasks (like email checking, for example). Using FoxyProxy on Firefox can help you with that.

  • I dealt with a similarly restrictive school and resorted to a VPN, they didn't like it, but one of the network staff pointed out that VPN traffic is no longer their problem. – Logarr Nov 4 '15 at 16:02
  • 17
    Any solution that involves installing their certificate makes you vulnerable even when not using their network. This is bad advice. – R.. Nov 4 '15 at 17:12
  • 2
    You don't have to install the certificate system-wide. Install it only on your alternative browser. – ThoriumBR Nov 4 '15 at 17:43
  • @ThoriumBR: That's a reasonable idea too. – R.. Nov 5 '15 at 0:36
  • That's a good idea for limiting the scope of what they can inspect, but don't expect your other browsers and applications to have any connectivity. – GuitarPicker Nov 5 '15 at 19:42
1

I believe you can safely use a Chrome OS device, with a dedicated "school" Google account that you use solely for access to the school network. Switching to a different account (e.g. your personal account) will no longer use the school's certificate or any of that user's settings, and Chrome OS is designed to securely isolate accounts.

This help article (written for domain admins, not users) mentions that this is possible, and also notes that it only applies while the domain user is logged in.

1

Do not bypass the firewall. Some other answers have already covered the technical options, but this is inadvisable - all of the filtering products I have seen will either block bypass, or allow it but notify an administrator, which will get you in to trouble. It may seem like a smart hack to do something that you aren't allowed to do, but the authorities will stomp on you - either by banning you from the network, which will make your studies difficult, or expelling you from the college. Either way, the potential impact on your long term life isn't worth the short term gain of having an unfiltered internet connection at college.

The only real technical option is to use your own internet connection via a 3G mobile or similar technology. You could install a local proxy, and route your HTTPS connections over the 3G link, and everything else over the college network.


SSL interception by internet filters in education institutions is becoming a widespread practice. If you want to take a stand against this, investigate your legal options. In many jurisdictions, interception of private communications without the consent of both parties is a violation of wiretap law. Even if the argument holds that you wilfully consented to the interception by installing the SSL certificate, it is certainly the case that the remote web site did not. As far as I know, no student has ever challenged SSL interception on this basis, but someone has to be the first. I was once told by senior staff at a filtering company that if SSL interception is illegal, it's not their problem - it's their customer who is breaking the law - and they have to offer it as an option or else they will lose sales.


The security on these internet filters/firewalls is often appallingly bad:

  • Some use the same SSL certificate for all of their customers. Trivial to extract with admin or physical access. If one firewall is compromised, every firewall is.

  • Use of old software with known security vulnerabilities. I know of one commercial provider with a current product line based on software released in 2004. If you can get user access, root access is trivial.

  • Insecure remote access. Support teams typically use the same installation and remote maintenance password for all customers. An attacker who knows that password can remotely access any customer system.

  • There is a "white list" of sites that SSL interception is not supposed to be done on (such as major banks). However, if you have access to the system it is trivial to modify the software to ignore or drop the white list.

  • I know of at least one case where an external attacker managed to gain access to the development server holding the source code for a major firewall product. The lead developer told me, "we have no idea how far they got in the internal network, or what they did once they were in."

The take home message is that these devices are quite vulnerable to a determined hacker, and once access is gained, they could trivially intercept every password of every SSL connection of hundreds of thousands of users. I'm surprised that we haven't heard anything yet about this kind of attack being carried out, but perhaps it already has and the hackers are too busy emptying bank accounts to brag about it. Public knowledge of such an attack would be hugely damaging for any firewall/filter supplier, and they would do everything they could to cover it up.

Update Dec 2015: Backdoors found in Juniper firewall, present since 2012.

  • "The lead developer told me, "we have no idea how far they got in the internal network, or what they did once they were in."" <- well yeah, presumably network security is not their job. – immibis Nov 10 '15 at 23:32
  • @immibis "We" as in "the company", not "I personally" – bain Nov 11 '15 at 12:29
-1

I looked for a way to use Tor over HTTP (without the proxy CONNECT command) when I first read your question but older answers all said it was currently impossible (I only found one proposal from 2013 that never got anywhere). Now I just stumbled across this, not sure it's what you need but it totally looks like it:

https://trac.torproject.org/projects/tor/wiki/doc/meek

meek is a pluggable transport that uses HTTP for carrying bytes and TLS for obfuscation

protected by AviD Nov 5 '15 at 9:03

Thank you for your interest in this question. Because it has attracted low-quality or spam answers that had to be removed, posting an answer now requires 10 reputation on this site (the association bonus does not count).

Would you like to answer one of these unanswered questions instead?

Not the answer you're looking for? Browse other questions tagged or ask your own question.