6

A number of solutions are available for tunnelling IP over Websockets to masquerade a VPN as browser traffic. How well are these connections isolated though? Specifically, if the browser happens to run on a host behind a corporate gateway that is set up to MitM all TLS traffic, will the gateway have the means to decrypt the tunneled connection?

AFAICS there is no suite of standards to consult as there is for IPSec, hence the lack of specificity in the question.

2 Answers 2

1

Websockets make use of https certs the same way all other secure webtraffic does. Thus if you have a corporate proxy between you and the internet, it is very possible that a corporate certificate has been installed on your company computer. This would allow the company to MitM all of your web traffic including websockets.

It is possible to encrypt the content of the websockets themselves, however, the code you linked is simply relying on the encryption of HTTPS itself.

  • You should expect that your corporate admin can see your traffic clear text.
  • You should also expect that since a LARGE amount of traffic is flowing through a websocket to a specific domain that it will be flagged as an anomaly and investigated with more scrutiny than most other connections.
  • Even if the your corporate admin do not understand what the traffic is, it will most likely trip the corporate IDS as a malware command and control gateway.
2
  • It would be trivially easy to run a ssh socks proxy through this websocket VPN to encrypt the traffic such that it could not be decrypted by your corporate admin, however, they would be able to see the ssh handshake at the start of the connection and thus know for sure that something shady is going on. Infact, it is very very common for IDS systems to look for SSH type communication over non-standard protocols (WS, ICMP, DNS). Your traffic would most likely be flagged. Aug 23, 2021 at 15:51
  • The weak spot is standard pool of trusted https certs, which allows corporate proxy to decrypt it. However, if client initiates connection to a https server using custom set of certs, generated on and signed by that server (also with full cert verification enabled on both sides), the traffic will either not be decrypted or be blocked by the proxy. And, as any other unrecognized traffic, it will be flagged as suspicious anyway.
    – Nik
    Aug 29, 2023 at 2:42
-1

Well, basically you now have VPN over untrusted connection. This should be fine, if VPN is implemented to deal with that (example that you list does not appear to be though).

If VPN correctly encrypts the data, then only entities in possession of keys (that would be you and your VPN peer) should be able to decrypt it.

5
  • This is incorrect. OP is using a WSS tunnel which falls prey to the same MitM attacks HTTPS does. Bluecoat can and will decrypt this traffic. Aug 23, 2021 at 15:59
  • I'm struggling here. Which part is incorrect?
    – domen
    Aug 24, 2021 at 21:58
  • The only part that is correct is that its a VPN over untrusted connections. VPN just means its a Virtual Private Network, it does NOT mean that its encrypted. The encryption in this case comes from the HTTPS traffic being encrypted, which is entirely negated by a MitM Proxy with a registered cert on his company computer. Aug 24, 2021 at 22:29
  • I agree with what you say, so I'm struggling to see where I was wrong. Maybe my wording is off/unclear?
    – domen
    Aug 25, 2021 at 9:25
  • "This should be fine" is the issue. As this VPN does not seem to encrypt anything, but rely on HTTPS, any MitM targetting the connection (like the corporate proxy) will be able to read/change anything on this "VPN."
    – ThoriumBR
    Sep 22, 2021 at 17:13

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .