0

I found out that the landlord of my building is able to access all my internet URLs even though they are HTTPS. Ex they are able to see this entire URL: https://www.google.com/search?q=stackoverflow including path and query params.

I verified by clicking on the lock icon of my browser that the certificate issuer is "Google Trust Services". They are able to see all URLs, not just google.

Therefore, I am not able to understand how are they able to access all my internet traffic (I am certain they are able to access it). I am not sure if they can see the request/response body & content as well. We are using AT&T internet (not sure if they have a Netgear Nighthawk router connected in the middle). I cannot access the router interface (192.168.0.1) because the attacker (the landlord) is able to see all my URLs.

Is there a way to thwart their attack by using some browser plugin or a similar solution? I found out that Chrome has HTTPS Everywhere Plugin but that might not help because my browser is already showing that the connection is HTTPS. Ideally I would like to find a way to also detect (and prove) that they are looking at my web browsing history, ex: I can create a website and use javascript to log visitor information (but it will be hard to pinpoint that they are the attacker), in case I decide to show it to our local authorities.

I use Firefox and Chrome for browsing the internet.

12
  • 3
    "I found out that the landlord of my building is able to access all my internet URLs even though they are HTTPS" How do you know this? – multithr3at3d Aug 17 '20 at 22:41
  • 2
    We can't really know what the problem is without a lot more information. It's possible they have full access to your computer, or a hidden camera in your building. Either way, it sounds like you should contact someone for help. – multithr3at3d Aug 17 '20 at 23:07
  • 3
    What you describe is not possible as a simple result of them being in control of the router. They would have had to get you to install something on your computer. – Conor Mancone Aug 17 '20 at 23:40
  • 1
    If your landlord has admin access to your router then yes they can likely see all of the URLs you visit. However if you are using SSL/TLS (e.g., HTTPS) then it's unlikely that they can also see the payload (e.g., your HTTPS requests/responses content). If you would like to hide your URLs from your landlord, then simply just use some web proxy instead. They even have ones for SSL/TLS too! – ManRow Aug 18 '20 at 4:29
  • 3
    @ManRow Every part of the URL other than the domain, port, and plausibly the protocol is part of the TLS-protected message (the "payload", as you put it). In particular, the path and query string are sent within the HTTP request (inside the TLS connection), and are not transmitted in any form in plain text. Also, while there are attacks you could launch from a compromised router, by itself owning the router does not give the owner any ability to read the full URLs. Just, as mentioned above, the domains and ports. Some additional info (like length) are also available but inconclusive. – CBHacking Aug 18 '20 at 5:33
3

In general, it is easy to get some information about the browsing of a person. The information that is leaked is:

  • site that you are using
  • approximate length of the URL
  • approximate length of the page
  • approximate number of other resources
  • time

See Are URLs viewed during HTTPS transactions to one or more websites from a single IP distinguishable? for a more elaborate explanation.

In a corporate environment, there are a number of vendors that deliver TLS decryption, for example Palo Alto does this. In general this requires that the MitM-device CA has been accepted as valid on your computer. You may have done this inadvertently, though with Chrome, that is very hard. Or someone with access to your computer may have done this. If the latter: if they install certificates like that, they may have done other things as well. You may want to re-install.

Key-loggers are also an option.

It may be important to know that there is no legal way for your landlord to do this without your explicit and informed consent (at least in the EU).

The second part is how to prevent this.

Depending on your level of paranoia, there are two things you can do:

  • reinstall the systems
  • use a VPN (NordVPN, ExpressVPN, etcetera)

It is also possible to flood your landlord's logs:

while : ; do
   ranhost=$(cat /dev/urandom | tr -dc 'a-zA-Z0-9' | fold -w 32 | head -n 1)
   wget https://$ranhost.com
done

which will make it harder for him to extract the real URLs that you use, and will also give him the signal that you know he is doing something illegal.

1
  • Thanks, I know that they are not technical to install Key Logger or fiddle with my device CA etc. I am sure there is some parental control type of device ex- Nighthawk connected over wifi. I will try 'flooding' idea as cover fire to login to the router and try to find that device and update this thread if I find anything. – codebee Aug 18 '20 at 18:28

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.