-3

It's been a while since SSLstrip is deprecated and I see no more options for SSL mitm because of OSCP/HSTS and browser counter measures.. Is SSL so unbreakable to common sys admins?

As the owner of the network I want to be sure what passes through my gateway but in means of data, i.e. not just that IP:PORT is connecting via 443 to this HTTPS site..

Even the last known vulnerability such as NTP Skimming attack requirese many aspects that most modern operative systems "fixed" or are hard to replicate in a real scenario..

Have you tried\Do you have any(recent & working) PoC of defeating SSL via Transparent Proxy/Proxy on your own gateway? (Please don't tell me about sslstrip or copy from google)

| improve this question | | | | |
  • Bluecoat etc offer this for enterprises. – Andy Boura Nov 28 '15 at 17:49
  • @AndyBoura: While SSL interception in the firewall is in principle MITM it is not considered an attack because it works only in consent with the user (or the company which uses the firewall) because they need to install the proxy CA of the firewall. Therefore I would not call it "defeating SSL" or breaking it. – Steffen Ullrich Nov 28 '15 at 18:04
  • Yeah, that's why I put as comment rather than answer as I figured it may help... – Andy Boura Nov 28 '15 at 18:06
2

I see no more options for SSL mitm ...

SSL man in the middle is still easy if some vendors install extra trusted root certificates on their system and include the private key. As example see Superfish and eDellRoot.

MITM is also possible if you know the private key of the site since the same key is shared with 1000s of other devices, see Nine percent of HTTPS hosts on the web "share the same private keys".

And of course MITM is possible if CA issue certificates for domains without authorization, typically done by local sub-CA's inside firewalls as can be seen here and here.

Apart from that: the technologies to defeat sslstrip etc not only have to be available but they have to be used:

As the owner of the network I want to be sure what passes through my gateway but in means of data, i.e. not just that IP:PORT is connecting via 443 to this HTTPS site..

As the owner of the network you don't need to attack SSL but you can use SSL interception most enterprise level firewalls (and even the free squid proxy) offer. Of course in this case the necessary proxy CA needs to be installed at the clients.

| improve this answer | | | | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.