0

My employer recently changed their WiFi network set up, and they now require accepting a certificate in order to connect.

Is there any way that I can check if they are performing a MITM attack to spy on the employees?

I would expect that I should be able to see which CA was used to establish a connection in my browser, but I'm not sure how to do this. If I see my employer's certificate, can I assume that they are able to see my unencrypted traffic, and if I see a different certificate, then it's not?

I also am loosely familiar with Wireshark, but I'm not sure if that's necessary.

Is there any way to make a determination or is completely unknowable?

10
  • 2
    Does this answer your question? Can I detect a MITM attack?
    – user
    Jan 4 '21 at 15:55
  • @user Possibly. I like the idea of those browser plugins suggested by the top answer, but they both seem to be gone now. And it's still not clear to me if it would help in my current situation. I don't know what the CA would show up as.
    – TechnoSam
    Jan 4 '21 at 16:13
  • @TechnoSam you would still know what CA should show up.
    – yeah_well
    Jan 4 '21 at 16:26
  • 2
    Are you mixing up accepting a WPA Enterprise certificate with accepting a root CA? Jan 4 '21 at 17:20
  • 3
    Note that some WIFI routers use certificates for validation when you connect to the router itself, which is perfectly okay and safe, and does not give the employer a way to MitM your connection. The issue is when you have to install a trusted certificate in your computers/browsers root certificate store. That is when you have to worry about them sniffing your traffic. Based on your comments, I suspect you are dealing with the former (although it's hard to say for sure from here) Jan 4 '21 at 18:44
5

I would expect that I should be able to see which CA was used to establish a connection in my browser, but I'm not sure how to do this.

It varies by browser, but in Chrome, for example, you would click on the padlock on the left hand side of the address bar:

Chrome address bar with padlock

Then click on the line where it says "Certificate":

Chrome security pulldown

After you click "Certificate", a new window will pop up. Click on the tab named "Certification Path" and look at the root certificate (the top certificate in the list). If that is the one your employer provided, then they are MITM this connection to this web site.

Certification Path

If I see my employer's certificate, can I assume that they are able to see my unencrypted traffic, and if I see a different certificate, then it's not?

Correct, that's how you can tell.

Is there any way to make a determination or is completely unknowable?

It's absolutely knowable. It would be labor intensive to try and do for every web site, but frankly, once you find your employer MITM one web site, you can assume they're doing a lot of web sites. Many employers exclude health and financial web sites from monitoring, for what that's worth.

4
  • They typically exclude Banking as well, as that would be a legal can of worms. Jan 4 '21 at 23:42
  • Hi! That's nice information. Can you help me with a similar but different concern. I sometimes use web-proxies from the following web site: free-proxy.cz/en/web-proxylist, just found it via web search. Now, this web site, as well as many of the provided web-proxies have red unlock sign (connection not secure). So does that mean that, all the web sites I visit, or data I provide are traveling un-encrypted between my computer and the web-proxy, so that anyone, including my ISP can monitor my internet traffic as well as data? Then what's the use of such a free web-proxy service?
    – Fat32
    Jan 5 '21 at 0:47
  • @Fat32 you should post that as a question.
    – gowenfawr
    Jan 5 '21 at 3:37
  • ok I posted a question, appreciate if you can read.
    – Fat32
    Jan 5 '21 at 21:56
1

First of all, let's have a look at how a Man-in-the-Middle attack works.

Instead of Alice connecting directly to Bob, Alice instead connects with Eve (who claims to be Bob) and Eve connects with Bob while pretending to be Alice.

This means that MitM attacks are active attacks, and not passive ones. An attacker cannot simply copy traffic passively and decrypt it there - they need to actively interfere with the connection.

About your Employer's Case

Here, "interfering" with the connection is basically equivalent with "providing" the connection. As such, when you use your employer's network, you can assume that your connection goes through a proxy, who will do some sort of inspection of the traffic and possibly block certain domains.

As for TLS interception, in order to do that, an employer needs a root certificate that your machine considers trustworthy, and act as a TLS proxy for the network. The easiest way to see if this was done is to check the certificate chain of a website you visit and compare that with the certificate chain from a connection you trust to not be intercepted.

On an intercepted connection, the root certificate will be the one your employer installed, whereas on the unintercepted connection, the root certificate will be a public CA.

What can you do about this?

Nothing. Plain and simple - nothing. You could delete the root certificate from your computer's trust store, but that will just result in error messages from your browser. If you choose to ignore the error messages and still proceed, your connection will be intercepted just like before - with the added downside that others can now also intercept your traffic and you wouldn't be able to tell.

So if you want to use the web without your employer knowing what you do, use a private device with a dedicated connection (e.g. your phone and mobile data) - do not connect this to any corporate device, I guarantee you that a slap on the wrist from the IT department is the best outcome in all of this.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.