0

This question may be confusing by it's title. My main question is, if it's possible for a Security Administrator to view encrypted packets sent to an HTTPS website? In present or past.

I work at a Tech support company and we are Tier 2 techs. Me and my co-worker was dicussing this and he thinks that the security guy can see all his information that's encrypted. I do know that they can see the information when I do Google Searches, but lets say if I go to an encrypted website like SkyDrive and I am logged into skype their via TLS will they be able to see this information?

5
  • 1
    Most likely he is a victim of projected paranoia or you have SSL proxy regenerating certificates. Check your SSL certificate in the browser. If it's orginal e.g. Google one (check the issuer), then he can't read. If you have AV then most likely you don't have keylogger or any screen grabbing software. However they can ponder around your machine likely. Also Google has now SSL so the searches are secret. Even if you visit a website there's no longer Referer from which google search / keywords it came.
    – Aria
    Jul 30, 2016 at 1:09
  • 1
    Probably not but if you're using their computer, there are many ways they could use to spy on you should they wish to including keyloggers, application changes, screen captures and so on. There is no way to be 100% sure on a computer you manage yourself so everything is actually possible on a computer you don't. Jul 30, 2016 at 3:18
  • When I go to the website on skydrive it says, "Symantec Corporation" for verified by. Is this a legit CA? Also when I look at certificates in Internet Explorer I see one CA is from the Government, but this CA I believe is used for smart card verification.
    – Kev
    Aug 4, 2016 at 16:44
  • There are SSL endpoints devices that intercept your SSL connection, and form there own SSL connection to your destination, and a SSL connection with you. Therefore, all the traffic in the middle in unencrypted. The certificated probably wouldn't match the destination cert, but it would still have valid SSL on both sides. The companies cert can be push to all PC so that it doesn't raise any browser alarms.
    – cybernard
    Sep 28, 2016 at 3:10
  • But he can keylog/view screen with terminal services.
    – user400344
    Dec 27, 2016 at 11:36

4 Answers 4

1

Just check the issuer of the certificate & any manually-installed 3rd party trusted certificate authorities.

And you can make sure by using Firefox as it uses its own certificate authority repository (Not like IE & Chrome which use Windows repository), which makes it harder for administrator to install the un-trusted certificate authority.

Also, this webpage helps: https://www.grc.com/fingerprints.htm

0

If some proxy is in place, and a trusted digital certificate is installed in your machine, what have to happen so he can intercept and decrypt this traffic on your proxy server.

That happens to work on some browsers, I can't guarantee if any browser has some hardcoded certificate verification, but the technique above is really common on large environments or else proxies won't see what user is doing, just the ip+port destination.

Other applications, if they rely on system's certificates, and there is an certificate installed as trusted, and this certificate is under your admin control, and the application don't use any other key exchanging mechanism like Diffie-Hellman, that can be possible too.

For example, SSH can use both RSA and Diffie-Hellman, in the case, using DH as a ephemeral algorithm, and the key generated will be forgotten when the session ends. Particularly in this case, a certificate under the system admin installed on the target machine won't help to intercept the traffic. And any attempt to do will raise a warning to the user.

2
  • 2
    SSH connections can be intercepted similar to HTTPS connections. But with SSH server authentication is usually not done using a certificate hierarchy and the user must trust the host key generated by the man in the middle same as the user would trust the real host key of the target server. It is less common but several firewall products support this. Jul 30, 2016 at 5:37
  • When I go to the website on skydrive it says, "Symantec Corporation" for verified by. Is this a legit CA? Also when I look at certificates in Internet Explorer I see one CA is from the Government, but this CA I believe is used for smart card verification. – Milt yesterday
    – Kev
    Aug 5, 2016 at 20:57
0

If you are behind a strictly configured corporate proxy, all your external traffic will be logged full point. It can be configured to unwrap HTTPS with its own certificate, log requests and only then proxy them (again in HTTPS) to the destination host. And of course it should reject any other traffic except from special hosts (a mail server for example).

You can indeed try to subvert that by not trusting the internal corporate certificate, but you will just not be able to browse any external site. Of course, you can use some sort of encrypted tunnelling to hide the actual data exchanged from the proxy, but this is probably not allowed by the corporate policy rules and could be seen as a deliberate security attack. You are on your own if you want to follow that way...

That being said, using the logs to examine what sites you consult is normally not allowed unless your usage is really abnormal, at least in most European countries. For example, in France, even at the time and place of work, employees privacy must still be respected.

0

My main question is, if it's possible for a Security Administrator to view encrypted packets sent to an HTTPS website

The administrator might see the website address but not the data transiting from and to your machine check this : https://www.eff.org/pages/tor-and-https

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .