0

Navigating to the below URL link from the Mozilla Firefox and entering some website link and clicking on View, displays certificate Viewer

chrome://pippki/content/exceptionDialog.xul

enter image description here enter image description here

After enabling Decrypt & scan HTTPS traffic from the firewall rule, all the clients cannot go to www because they don’t have SSL CA Certificate.

So they have included the SecurityAppliance_SSL_CA (.pem format) and installed on to the client machines from the Microsoft Management Console (MMC) i.e, from the Trusted Root Certification Authorities > Certificates. Performing Import *.pem file

And also included a private key specific to the static IP address identified unique specifying the Friendly Name to be SSIS Master Service

It's very clear that they are not using any proxy server.

Firefox detected a potential security threat and did not continue. Because Peer’s Certificate issuer is not recognized.

HTTP Strict Transport Security: false

HTTP Public Key Pinning: true

I do own an Anti-Virus software from Sophos Endpoint Security and control for my personal PC, with Web protection enabled. But I don't get any sort of messages from the FireFox

enter image description here

So my question is what is the purpose of doing this? and Does our passwords gets decrypted in an encrypted websites via MITM decryption or store logs? Is there any way to get around this?

Improve this question
3
  • are you aware what "Sophos" is as the certificate issuer?
    – schroeder ♦
    Nov 11, 2019 at 9:00
  • 1
    community.sophos.com/kb/en-us/…?
    – mootmoot
    Nov 11, 2019 at 10:25
  • ESET, G-Data,... a lot of AV vendors offer HTTPS interception. How else can they scan your downloads when they pass over HTTPS?
    – Nomad
    Nov 11, 2019 at 20:05

1 Answer 1

Reset to default
2

what is the purpose of doing this?

The antivirus wouldn't be able to detect a virus/exploit that was delivered through https. Breaking the https connection would allow it to detect and block such threat.

It's very clear that they are not using any proxy server.

No. There may not be a configured proxy server, but the aforementioned firewall is acting as one, apparently in combination with a Sophos instance (this will be a transparent proxy).

Does our passwords gets decrypted in an encrypted websites via MITM decryption

Yes. Anything that goes through the MITM connection will be decrypted and then re-encrypted

or store logs?

You should ask to the person that configured this system performing a MITM

Is there any way to get around this?

Disable the "Decrypt & scan HTTPS traffic" rule? It may be possible to configure specific destinations that shall not be subject to MITM.

Also, it could be that connecting through a proxy / VPN allowed to bypass this specific security setting. But in this case I don't think it would be appropriate. If you are allowed not to go through this filtering, you should get this rule disabled. If you are not allowed to bypass it, it seems unwise to work around it without authorization.

Improve this answer
2
  • Do you think my AV will be able to scan only Non-SSL based website?. If this XG Firewall alone is configured to scan & decrypt SSL based website. In such case, why would some one go for choosing another product of AV installed on all the client's machine.
    – Nɪsʜᴀɴᴛʜ ॐ
    Nov 12, 2019 at 4:22
  • Yes, I agree with you they were not using a Regular Proxy, instead Transparent proxy had been detected from the following HTTP headers: Via HTTPS/1.1 forward.http.proxy:3128 X_forwarded_for the public IP(xxx.xx.xxx.xx) If this product continues to sold as a MOTS, rather than COTS, then they'll be serious threats to our privacy
    – Nɪsʜᴀɴᴛʜ ॐ
    Nov 13, 2019 at 5:03

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .