3

My ISP provides a transparent proxy to use and I can see that they are using the squid proxy for caching this.

What I am wondering is what data can they see and what can they see further if they can probe with the proxy?

I know HTTP traffic is visible regardless of proxy but what about HTTPS ; are they able to see it? Since they control the proxy can they MITM and see my cookies, headers, GET POST requests and traffic? What are they able to do?

  • Every single packet that goes to you or goes to world from you, is seen by them, so they can do anything to your traffic.. There are way to intercept SSL traffic as well, so yes, they can see SSL traffic as well – Hamza Islam Oct 7 '16 at 6:59
5

Effectively they can see everything you do that's not encrypted or sent through a tunnel and in many cases they can see what type of traffic that is too via DNS. I'll list a few examples:

What sites you frequent.

When you're active on-line.

What operating systems you use and in many cases what software you use.

How often you patch your computer.

The firmware of mobile devices can be detected via http user-agent strings.

Who you bank with.

Social media habits.

They can use this info to do political profiling, or profiling for marketing purposes.

In some cases which types of IoT devices you own.

They can geo-locate almost every packet you send and where it's going too.

If you go beyond the Squid proxy you can also include the following:

The DNS lookup for every website you visit and the domain for every message you e-mail. This includes DNS lookups when you go to HTTPS websites.

clear-text SMTP mail (all of the message when sent in the clear).

Types of activities like torrenting files

Connections to the Tor network

Common traffic patterns sent through encrypted tunnels. ( i.e. downloads vs chat )

An additional note regarding HTTPS is some websites have mis-configured settings such that cookies are sent via clear-text HTTP. So in that case they would get copies of those too.

IPv6 connections your devices may make including HTTP or HTTPS over IPv6 if your ISP supports it (Many do).

etc... Some ISP's record pretty much everything.

Aside from the DNS requests and cookie leaks the rest of your HTTPS traffic should be relatively private.

It's very unlikely that they would MITM your connection but this depends on what country you are in (it does happen in some repressive regimes). That said if you weren't careful about not accepting certificates or installing any software they provided it could happen. Some governments have required citizens to accept a key they can use to decode traffic if this is the case ALL of your traffic is visible. This is rare but I don't know where you are from so I thought I'd mention it.

0

To play MITM with HTTPS your ISP would need to create a fake server certificates on the fly for the domains you visit. Your browser would flag these certificates as security problems, since they would not be signed by any trusted CA. That is, unless you imported the CA certificate used by the ISP as a trusted CA. In that case your browser will think everything is fine.

This maybe the case, if your provider required or tricked you into importing the CA cert, or he controls your client (like some mobile providers do, or in some corporate settings).

To check whether anyone messes with your HTTPS connection you can use a service like GRC Fingerprints (https://www.grc.com/fingerprints.htm) to compare the fingerprints of the certificates actually sent by the servers with those you see. If the fingerprints match you can be sure you are talking directly with the intended server, with no MITM listening in.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.