Supposing I have connected my laptop to the ethernet cable and all the traffic in the ethernet cable is encrypted (let's say VPN, HTTPS, etc.). Can someone who is eavesdropping the traffic with physical access to the Ethernet cable (via an Ethernet keylogger or maybe inductively, etc), decrypt the traffic and gather sensitive information?
5
-
2Why do you believe anyone would be able to decrypt the traffic?– vidarloCommented Mar 1, 2023 at 15:46
-
The question is: Is it feasible?– user958473Commented Mar 1, 2023 at 15:48
-
2Well, why do you think it would be possible? Do you believe TLS (https) is not good encryption?– vidarloCommented Mar 1, 2023 at 15:48
-
1Why is physical access a factor? Are you not just asking "can HTTPS be decrypted?" What is an "Ethernet keylogger"?– schroeder ♦Commented Mar 1, 2023 at 19:13
-
1I think his question is more on the lines of the entire key exchange process, not just the HTTPS data traffic. Or "if I had the entire communication from start to end (including the key exchange) can I eavesdrop that encrypted communication?" but probably not aware of the asymmetric keys (or how/why it protects) used for the key exchange of the symmetric key.– AustereGrimCommented Mar 1, 2023 at 19:43
Add a comment
|
3 Answers
The short answer; in theory yes, in practice no.
There's two principles you should know before I explain whats happening;
Asymmetric algorithms; public and private keys, used for the encryption and transfer of symmetric keys. https://cryptography.io/en/latest/hazmat/primitives/asymmetric/index.html
and Symmetric algorithms; typically a faster encryption however still very strong. https://cryptography.io/en/latest/hazmat/primitives/symmetric-encryption/
I'll address the two examples you question the encryption. I have access to your ethernet cable, and all the data traversing it.
You're on a VPN
A VPN connects with a asymetrical key transfer; client gives server (public) encryption key, client keeps (private) decryption key secret, server gives client it's encryption key and keeps the server's decryption secret. They then transmit a key for a "faster" encryption method through that "slower" encryption method.
You then encrypt all the network data to the VPN server with that faster encryption method. Local network header information (metadata) is not encrypted, but the VPN connection has it's own network header information in the packets data. Where it's a packet inside a packet, all that new network traffic is encrypted.
Through metadata I don't know your destination other than that VPN server, you can connect to any website or system through that network and I won't know. I just see you talking to a VPN server.
In theory, with all the time and resources in the universe, I can eventually decrypt the data. In practice however it's probably in the time frame of 8000+ years. I could target the faster encryption method where all the data is, or I could try to target the assymetrical encryption and decrypt the conversation that transmitted the symmetrical keys. Still, in practice, either is significantly difficult right now to compromise.
You're connecting to HTTPS
It's actually very similar in situ, but only the the HTTP data is encrypted.
Your browser talks to the HTTPS server with assymetrical encryption, and then transmits a symmetrical key for (faster) encryption. This can also compress the data. Then both computers transmit using the symmetrical key encryption.
I can see what site you're going to (IP Address and DNS requests), and monitor your activity (throughput), but what is being discussed and transimitted is hidden through that faster encryption. So I can see you're going to naughtysite.com and that you've downloaded 800mb of data, but I don't know what video you've watched, nor can I see the video content itself.
Again, I can attempt to attack the asymmetric keys where I'd can get the symmetric key, or just attack the symmetric key encrypted data. Both of which would take a really long time to attack. And I believe, the symmetric key may change over time throughout the connection to the server, so I may have to attack multiple symmetric keys and not know where/when in the conversation that change has happened.
Weak Encryption
So all of that assumes you're using strong encryption algorithms. There are weak algorithms no longer used in practice, primarily because they are "easy" to decrypt, or they have major flaws that are easy to break. Which is why you want to make sure you're using a VPN or HTTPS with strong encryption algorithms, but again they typically aren't used in practice, just in study. (an example off the top of my head is WEP for wifi encryption)
But that doesn't mean the encryption algorithms we use don't have a flaw we don't know about today, and next week we might find that flaw, where that once strong encryption is now broken. So everything I've captured today, I might decrypt next month.
Vulnerable Software
The remaining part of the chain is the software used to encrypt the traffic and exchange those keys. If there is a vulnerability in that software where I can compel the software to release the key to me or change the key to something I want, then I can compromise the communication and decrypt or inject data.
-
To be more precise, can data encrypted with AES (inside the ethernet cable) be eavesdropped/altered/decrypted? Commented Mar 1, 2023 at 18:11
-
1The answer is still "in theory yes, but not practically." With all the computing power in the world, yes eventually the data could be decrypted and "eavesdropped". Altered is a very different question, as I would need to be able to re-encrypt the data and pass any other validations in near real time. Commented Mar 1, 2023 at 18:55
-
1
-
1Proxy use does not meet the qualification of the question, just access to the "physical cable", presuming "data keylogger" means port mirroring, and "maybe inductively" to signal level capture decoded to just the data stream between a server and client. Commented Mar 1, 2023 at 19:50
-
1Because yeah, I could set up a computer where I own and trust a CA, and my proxy server intercepts and forges certificates from any website using my trusted CA, and can inject keys becuase it's completely a trusted interception. Commented Mar 1, 2023 at 19:54
No, it is not currently possible to decrypt properly encrypted traffic.
That said, if weak encryption is used, data may be at risk. Furthermore, some traffic may not actually be encrypted. For example, DNS traffic may not actually be routed over your VPN connection. This could at least disclose the domain names of the sites you are browsing to.
In order to do so, they would have to breach all the encryption methods, starting from the Layer 2 encryption (ethernet, or vpn if it runs on layer 2) and the rest. It is possible but becoming challenging with each step. As an example, if vpn is vulnerable or if the ssl website is vulnerable to attack such as ssl stripping or heartbleed, then it makes it possible. If you are using openvpn, here are some of the openvpn protocol vulnerabilities , hence that is the most popular vpn protocol. But again, every layer of encryption is a challenge.
