I've seen several questions that deals with SSL Inspection, none of them really carried a detailed response on the secure way of doing so.

The reason I'm asking is because of this: Cyberoam fixes ssl snooping hole in network security appliances.

Can you explain the security breach here (how can attackers leverage this hole)? What should they have done? How can I protect the users on my network? What can be done if an attacker have their old certificate (and how)?


SSL inspection is essentially a man-in-the-middle attack done with the approval of the owner of one end of the transaction; Alice thinks she is establishing a secure channel to Bob, but really she is establishing a secure channel to her employer Eve, who reads the traffic, then establishes a secure channel to Bob and passes it on.

In order for this to work, Eve has to generate and sign a fake certificate for Bob and use it to secure the communication with Alice. Eve is able to do this because Alice's computer has Eve listed as a trusted Certificate Authority. (Eve owns Alice's computer, so was able to add herself to that list.)

So, Eve is a trusted CA for Alice's computer. Except it's not actually Eve who's the CA, it's Eve's Cyberoam appliance. And the problem is that Cyberoam appliances all ship with the same default certificate on them, so Alice doesn't just trust Eve's Cyberoam, she trusts all Cyberoams.

This means that an attacker, call him Mallory, can buy a Cyberoam, dismantle it, and use it's fake certificate generator to make certs that Alice will trust. Basically, the work Eve has done to let her do a MITM attack on Alice and Bob's communications can also be used by Mallory to do a MITM attack on them.

To fix this, Eve needs to use a unique certificate on her particular Cyberoam appliance and not the default one it shipped with.

Eve should really have done this when she bought the appliance. Sure, dismantling a Cyberoam is hard, and even with the ability to forge trusted certs, a MITM attack is hard, so it is not a major risk unless Eve expects a determined and targetted attack.

However, generating a unique cert is a 30-second job and she should have done it. It will take Eve a little longer to do it now, since she has to replace the CA on Alice's list.

Lastly, to be fair to Cyberoam, it's not just them that ship with a default cert on their boxes. This is as much Eve's fault as theirs. As a general rule, if you're using SSL inspection, you are deliberately weakening the security of your network, and must take a lot of care doing it.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.