Using Squid's SSL Bump feature I can intercept (and inspect) all web traffic on my home network.
Now, assuming that I can now see the plaintext communications to/from a client, that still may not do me any good because if I'm using a secure backup provider where my data is encrypted first before it is sent out, all I will see is another encrypted stream. Then, even if it is decrypted, I need to know the data structure. Additionally, the IP address may simply resolve to Amazon or some other large provider which could be a blackhole.
If I want to inspect that stream, I need to know the key (which, fortunately, for me, I know where the key is, as it is mine after all), but let's say I'm paranoid and want to be sure that perhaps I don't have a backdoor that is leaking sensitive data to a malicious actor. I would then need to leverage tools on the workstation itself to see what file(s) were used to do the encryption and write the stream across the network.
Is that something that can be detected in real-time, or has to be done after-the-fact? And, I assume that if it were to exist, it would be enterprise-security that I cannot run on my personal network for either cost-prohibitive reasons, licensing, etc.
Would I be able to have that tool detect all plaintext streams (no additional encrypted detected) and then only flag ones where the data is additionally scrambled? I'm hoping that it can also detect (by running an agent on the workstation), the key(s) used to encrypt the stream so then I could easily identify if the activity were malicious or not.
If so, what sort of tools would allow me to do that?