1

I am curious about security of proxy servers. I read a few threads and all of them were overly general or missed the point I am interested in, the devil is in the details.

SCENARIO

The malicious agent has a proxy server and HTTPS traffic goes through it, e.g. a client making connection to an HTTPS protected website.

MY QUESTIONS

  1. What is the span of the HTTPS protection? Does it protect traffic between client and destination or is it only in between proxy and destination?
  2. Is it trivial for the malicious proxy to directly sniff critical data? With trivial I mean not using significant computational power. With critical data I mean things like secrets or passwords not metadata like IP addresses and so on.
  3. Do SOCKS and HTTP protocols make difference in the difficulty of such attack?

Other factors should not be assumed, or assume worst case scenario.

1

What is span of the HTTPS protection? Does it protect traffic between client and destination or is it only in between proxy and destination?

With a HTTP proxy the client requests a tunnel to the server (using HTTP CONNECT request) and then creates an end-to-end TLS session between client and server over this tunnel. A non-intercepting proxy will only forward the initial handshake and the encrypted data.

An intercepting proxy though might terminate the TLS connection from the client at the proxy and create a new one between proxy and server, thus having access to the decrypted traffic. Of course the proxy cannot use the original server certificate, thus the client must somehow trust the certificate generated by the proxy. This is either because the proxy is trusted and has its CA in the client (i.e. corporate proxy, local antivirus) or because the client has explicitly ignored the warning that the connection is not trusted.

Is it trivial for the malicious proxy to directly sniff critical data. With trivial I mean not using significant computational power. With critical data I mean things like secrets or passwords not metadata like ip addresses and so on.

No, since a non-intercepting proxy will only see the encrypted traffic and the certificate of an intercepting proxy will not be trusted by a proper client.

Do SOCKS and HTTP protocols make difference in difficulty of such attack.

There is no practical difference, its only a small difference in the initial data between client and proxy (i.e. HTTP CONNECT vs. SOCKS handshake).

| improve this answer | |
0

How far does the HTTPS protection go?

That depends what the adversary does with the proxy. If all they do is logging and forwarding, then the adversary will see limited amounts of detail (for example, the host name of the server), but the rest will be protected by TLS.

If the proxy tries to break the TLS connection and act as a "real" proxy, then you will likely get a TLS warning in the browser if the root CA of the proxy is not installed on your system. if it is installed, then the connection will look normal to the client.

Is it trivial to directly sniff data?

That depends on a number of factors, such as the environment you are in, or what you consider critical data.

For example, if you are connected to a public Wi-Fi, then it is indeed trivial to sniff the data. After all, you are literally shouting it in every possible direction as loud as you can.

Even worse if you think you connect to public Wi-Fi, but it's actually a hot spot set up by an attacker. Then the whole Man-in-the-Middle attack is built by design.

If you are on a wired enterprise network, an attacker may use ARP spoofing to get you to connect to them instead of your gateway.

If you are on your home network without any other hosts, the attacker would need to be at the ISP or close to the receiving server, which makes it very difficult.

All of these attacks require the attacker to have their certificate installed as root CA on your machine. This is a very difficult task, which is what makes PKI trustworthy.

Do SOCKS or HTTP proxies make a difference?

I don't know too much about SOCKS, so perhaps someone else can answer that.

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.