1

Here I am describing the scenario which I used to login to my Gmail account.

  1. A fresh installed Windows Laptop was given to me with chrome installed.
  2. Connected to WiFi network of my college.
  3. Signed in to Gmail using Incognito Window of Chrome browser.
  4. Signed out of Gmail.
  5. Closed the browser and given to my professor to discover my unsaved password.
  6. And he found my password within 15 seconds.

I assure you that there was no keylogging applications were installed and my professor refused to disclose the method which he used to discover my password and I am really doomed now.

I am pretty sure my professor had no access to the laptop before and he can do this trick on any computers which is connected to our college network.And no sniffers or malwares were on the laptop as I have checked the services running under Task manager.

I just want to know how he did it.Do anyone know how he did it?

I think that the college network might be using cookies to track the activities of user and I think the login data is saved in the Network.

closed as too broad by Steffen Ullrich, Marcus Müller, tim, CaffeineAddiction, Xander Feb 25 '17 at 18:36

Please edit the question to limit it to a specific problem with enough detail to identify an adequate answer. Avoid asking multiple distinct questions at once. See the How to Ask page for help clarifying this question. If this question can be reworded to fit the rules in the help center, please edit the question.

  • Did you login to gmail with https ? – Xavier59 Feb 25 '17 at 7:43
  • 2
    Gmail is served with HSTS. There's no way not to. – Stephen Touset Feb 25 '17 at 7:44
  • 5
    You can't trust a readily set up laptop. So quite possibly there simply was a key sniffer or some other observing malware installed. Occam's razor. Unless you explain why you don't believe that, this is the most likely explanation. – Marcus Müller Feb 25 '17 at 7:45
  • 1
    @Marcus I agree with you, I'm also very much hoping for a resolution. Still I feel like this is wrong. 99% of the class will go 'Wow I really should be more careful' But there'll be this one percent that goes 'Interesting, will try with my girlfriends laptop.' Don't get me wrong, I believe in the good of humans. But from my own experience, especially in Security, there's this one person, that has little skill and yet wants to pwn em all, no matter the cost. – FMaz Feb 25 '17 at 9:55
  • 4
    A fresh installed Windows Laptop was given to me So, somebody else installed software on this computer.In other words: this is not your computer and you entered a password on a computer that is owned by somebody else. What did you expect? – Jacco Feb 25 '17 at 11:08
3

I'm not entirely sure, but I believe that any decent corporate firewall has the tools to do some decent (deep) SSL inspection.

This is available to firewalls in order to do application control, antivirus scanning, data leakage prevention, etc.

Basically client SSL connections can get proxied through the firewall and unless this "freshly installed computer" would not trust the firewall's certificates itself, it appears to be technically feasible to log sensitive data on the firewall.

How HSTS comes into play with these proxy-based is not entirely clear to me, but I guess that unless OP was using a recent legit version of Google Chrome to navigate to gmail.com, it would be difficult to entirely exclude this "SSL inspection" possibility. Even if he did, I am not sure SSL inspection is undoable.

In any case, whether or not its done via a firewall, this would probably require a certificate to be preinstalled in the PC's cert store.

  • 1
    Network inspection tools require that the firewall's root certificate to be installed in the user's browser. User installed certificate is exempted from certificate pinning enforcement, i.e. you can intercept a pinned site, if you have installed a custom root certificate in your browser. – Lie Ryan Feb 25 '17 at 11:16
  • Thanks for confirmation! This means that OP's professor will probably have handed him a "freshly installed" academic PC with standard preinstalled root cert for general connectivity purpose. If "deep" SSL inspection is enforced in OP's academic environment this would be a prerequisite for accessing encrypted websites anyways, whether or not sensitive data would be logged. – bnqprv Feb 25 '17 at 11:23
  • 1
    Avoid unneeded "...", it looks really bad. – peterh Feb 25 '17 at 11:24
  • @peterh agreed, sorry. Am new to posting on stack... ;) – bnqprv Feb 25 '17 at 11:27
1

Consider the possibility of being victim of sslstrip+ sniffing attack (or also called sslstrip2). If you are connecting to the college wireless network, maybe the professor has the control of the router (already MITM), or maybe did you an ARP poisonning attack (probably the first one).

Once MITM (Man-In-The-Middle) is done, you can sniff traffic. If the site is served using SSL (https sites), you need to do sslstrip to do that. If the site has HSTS (Http Strict Transport Security), the SSL is forced but you still can do sslstrip using the first plain http request before being redirected to https. And if in addition the site is a "famous" site, like Facebook, Twitter, Gmail, etc... there is no first plain http request even if you ask for "gmail.com" because the modern browsers have internal a site list with this "famous" sites which are known using SSL. So standard sslstrip is impossible... but that's the reason sslstrip2 exist.

You can sniff passwords from SSL sites with HSTS if you use ssltrip+, which is composed by an DNS and an PROXY in addition of the standard sniffing and sslstrip.

The mechanism how it works is basically "tricking" the victim by DNS. When the victim is asking for example for "www.gmail.com", it redirects you to another domain name which is not in the HSTS browser's lists. Usually something like "wwww.gmail.com" <- note the 4 w. With the DNS and the PROXY, the victim is accessing to a served sslstripped Gmail while attacker is doing the connection to the real SSL site.

So is not impossible. Maybe you were victim of this. If you want more info, check this article.

It works, I tested it lot of times using tools like Bettercap (and ther are other tools too) which combine this kind of All-in-one technologies.

Not the answer you're looking for? Browse other questions tagged or ask your own question.