Can Wireshark or other packet sniffers be used to decrypt https sites of someone else?

Question

Does Wireshark(packet sniffers in general) let you decrypt someone else's https sites, or only your own? For example if the router is hacked can a packet sniffer give the attacker the ability to decrypt every https site you visit from each device connected to the router?

On the site of Wireshark it says that there are 2 methods : Key log file using per-session secrets and Decryption using an RSA private key.

Can the attacker get your "Key log file using per-session secrets" remotely? I know that if you are doing this, you can instruct your computer to write the "key log file using per-session secrets" down somewhere and from there you log it to Wireshark. Since the attacker controls your router, Can he do the same thing, instruct your device(computer,smartphone) to write this down somewhere so he can use it for decryption of https? Can the attacker get it If he controls your device/is able to see the contents from your device via virus, malware ?

Does the attacker need both Key log file using per-session secrets and RSA private key to decrypt https or is only one of these needed?

From what I know the RSA private key cannot be acquired from the site you connect to nor from the victim. correct me if i'm wrong. How can one get this key? Is decryption of https possible without this key? is Key log file using per-session secrets enough for decryption?

The reason why Im asking this is because my router was hacked, I was reading some things and I want to know what is possible to have happened.

Answer 1

The whole reason TLS exists is to protect you from someone who controls your router, classically in an internet cafe. If TLS doesn't protect you from that, TLS has no reason to exist and web browsers like Chrome have no reason to behave any differently between http and https sites.

TLS does protect you. But! Someone in control of your router can do a lot of bad stuff, classically they would intercept an unauthenticated download of an executable, for example a software update, and replace it with a backdoored one, and then when they have their code running on your computer with the permissions of that software, probably with access to all your user's files, they will continue the attack and TLS won't matter. TLS is necessary for security, but it's not sufficient.

EDIT

Modern TLS doesn't support it, but old TLS had "RSA cipher suites" (TLS_RSA_with_...), which are cipher suites that don't provide Perfect Forward Secrecy, don't use any kind of Diffie Hellman key exchange, and use RSA encryption for key agreement instead. To decrypt traffic of connections established using RSA cipher suites you need the private key for the server's certificate. Unless it's your own server, you're not going to get it.

Modern TLS only supports cipher suites that provide PFS (in practice, always using ECDHE). Traffic in connections using these cipher suites is protected by a per-connection key, and so to decrypt it you need someone who knows the per-connection key to tell it to you. Unless you control the server, the server is not going to give you the per-connection key, so usually people get the client (e.g. a web browser) to log the per-connections keys. People can do that because they control those programs that run on their own devices. When using SSLKEYLOGFILE, Chrome will log all the info needed to decrypt the traffic later, regardless of the cipher suite, that's why internally that file has different formats for different cipher suites.

Again, without the keys either from the server or from the client, you can't decrypt a recorded TLS connection (which is the point of TLS).

Chrome won't write a SSLKEYLOGFILE by default. It will only do that if the user runs chrome with the right options. If the attacker can make Chrome on your computer run with SSLKEYLOGFILE, they can probably also replace Chrome with a backdoored browser of their choice that looks like Chrome but secretly reports everything you do and type to the attacker, without sniffing TLS.

If your endpoint is completely compromised, transport security won't help you at all.

I don't understand your focus on the details of TLS decryption. Either your computer was compromised, or it wasn't. If it was, everything it had access to is compromised, and if it wasn't, only plain http traffic was sniffed and potentially replaced by the attacker.

Want to be safer? Assuming you don't have a backup from before the breach, make Chrome export your passwords and bookmarks (or sync them to google cloud) to a file, boot from a USB thumbdrive, backup documents (not executable programs), format the PC and install a clean OS, then install all the apps and restore documents from the backup. Use something like google apps to process document files if they could have been tampered with. Make sure someone didn't configure your email to copy everything to a different account, etc. Good recommendations for all this are not under the tls tag, but I'm sure you can find them.