0

Using Squid's SSL Bump feature I can intercept (and inspect) all web traffic on my home network.

Now, assuming that I can now see the plaintext communications to/from a client, that still may not do me any good because if I'm using a secure backup provider where my data is encrypted first before it is sent out, all I will see is another encrypted stream. Then, even if it is decrypted, I need to know the data structure. Additionally, the IP address may simply resolve to Amazon or some other large provider which could be a blackhole.

If I want to inspect that stream, I need to know the key (which, fortunately, for me, I know where the key is, as it is mine after all), but let's say I'm paranoid and want to be sure that perhaps I don't have a backdoor that is leaking sensitive data to a malicious actor. I would then need to leverage tools on the workstation itself to see what file(s) were used to do the encryption and write the stream across the network.

Is that something that can be detected in real-time, or has to be done after-the-fact? And, I assume that if it were to exist, it would be enterprise-security that I cannot run on my personal network for either cost-prohibitive reasons, licensing, etc.

Would I be able to have that tool detect all plaintext streams (no additional encrypted detected) and then only flag ones where the data is additionally scrambled? I'm hoping that it can also detect (by running an agent on the workstation), the key(s) used to encrypt the stream so then I could easily identify if the activity were malicious or not.

If so, what sort of tools would allow me to do that?

2

You are asking for a single tool to do a very complex and unreasonably specific set of things. Technology is a stack, and there are various tools that can do parts of what you want. And not all of those tools are security-related, even if you want to use them for security-related things.

  • Packet captures, like Wireshark, can watch the network.
  • There are no tools to determine whether something is malicious while it is doing something normal, but anti-virus/anti-malware can match the behaviour of a process to known malicious activity. Simply doing something encrypted is not an indication of "maliciousness".
  • And then, even your expected tool requires the manual step of you using that information to perform forensic analysis on whatever anomalous processes your tool discovered, which means it comes down to this last step.

For forensic analysis you need:

  • a baseline of what's normal for the system based on the various data below
  • packet captures, which will show you the source port of traffic on your system
  • a running log of running network processes from the OS, the location of the process (the 'file'), and the source port that is used to communicate to the network

From these 2 logs of information, you do not need a "key" to inspect traffic, merely to know what is normal for your system for the processes you run.

The above tools to generate packet captures and OS process logs are free (and in some OSes, built-in).

And there is a reason why even large enterprises don't run these tools in real-time on an endpoint device: the amount of data to slog through is enormous and resource-intensive to use in order to find malicious or anomalous activity that can be found in more efficient ways.

If you have a targetted suspicion that something is happening, you use the above method. If you want constant monitoring, it's not efficient.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.