Organisation's use of SSL inspection and duplication of root CA certs

Question

An organisation (a school in this example) requires connecting personal devices to install root CA certs to allow SSL inspection to occur. Whether is this ethical or unethical is another issue - in the context of verifying that the content accessed is appropriate for a school, SSL inspection is probably overkill and begs a question as to why SSL inspection is actually implemented on the network.

The organisation's administration staff do not properly understand the security issues present with this setup and thus the issues cannot be communicated back to the network administration staff.

Guests are encouraged to have their device join the network, which then the root CA certificates are required to be installed and accepted.

The root CA certificates were issued for 10 years from 2016 - a recent upgrade to the network required them to be re-issued and re-installed, meaning old root CA certificates are still installed on hundreds, if not thousands of machines.

Clients (students) - hundreds - leave every year and their personal devices will still have the root CA certificates installed, with no instruction provided by the school to remove them

Is this quite significant? or should it all be ignored - how can you express the issues associated to computer illiterate administration staff

Answer 1

Let's unpack your questions:

Is this quite significant? or should it all be ignored

and

how can you express the issues associated to computer illiterate administration staff

tl;dr: "It depends".

You've already discussed the privacy / ethics concern with the school fully monitoring all traffic of all devices in their building, so let's assume for now that we're ok with this and talk about the technical concerns:

1. The CA was rolled over and the old one left of devices.
2. Graduating students (or guests leaving the building) do not remove the root certs from their trust stores.

Before we can go any further, we need to define our threat model. I assume you're worried about random cyber-criminal-hacker-trenchcoat people compromising these devices because of the presence of these trusted roots?

I think there's only two ways this can happen:

1. The CA cert uses weak crypto and can be brute-forced before it expires.

Certainly a 10 year cert on RSA-1024 would be in this category. You'll need to look at the root cert itself to see what crypto they're using.

2. The admins were sloppy about storing the private keys, and hackers were able to hack into the school and steal the private key file.

Yup, now any website visited by a device with the school's root cert could potentially be a phishing site and the device / user won't know the difference.

So, the question is: how hardened are the school's networks against the CA cert private key being stolen. For example, has the school hired external penetration testers to help them harden? The way to pitch this to administration is the cost of hardening the network vs the risk of making every student / staff / guest's device vulnerable to attackers both on and off the school's network.

Answer 2

A lot of the security hinges on how well the SSL certs and proxies are managed.

root CA certificates were issued for 10 years from 2016

...so not very well.

The organisation's administration staff do not properly understand the security issues

Do you mean the staff responsible for the administration of the organization or those specifically responsible for the administration of the service? If the latter, then be very afraid.

how can you express the issues associated to computer illiterate administration staff

(see previous question)

If we're talking about the organizational risk, then the biggest one is that of liability.

Answer 3

To answer the why they do it you have to aware of how easy it is to circumvent content filtering when https is involved. Google switching to https only a few years back caused a big headache to a lot of schools and their existing filtering software.

The only thing you can detect without intercepting the https request is the domain. That makes it easy to detect say pornhub, but switch Google safe search off and do an image search for whatever sexual term you like and the domain will still be Google, but the content will be decidely not suitable for minors.

The school basically has no option except to do some sort of mitm approach or not to provide wifi.

As to publicizing the actual means of doing it and/or how to remove it afterwards they probably could do better but most teens would sell a kidney for free wifi and they will have forgotten about it in a couple of years.

As other answers have mentioned they could do better technically and there is a risk of total https compromise of the browser but I would consider it quite a low risk. If the NSA or Mossad is after you they will get you...someone hacking the school and then man in the middling a local coffee shop is possible but not something to lose sleep over. Especially as most connected devices only have a 2 year lifespan.