7

I am working in a IT company. I am using LAN for all internet activities. I send some email from my personal gmail account. My network administrator sniffed all email I send from LAN and he shows the email to me.

I am sure no software installed my system and I used https to send email. How did the network administrator sniff my email? How can I prevent this?

2
  • you were using the gmail https interface to send mail, or another email client? Where did you send the email to? Someone in your company?
    – schroeder
    Commented Jun 17, 2013 at 14:31
  • 4
    Use your phone and stay off company WiFi
    – DKNUCKLES
    Commented Jun 17, 2013 at 16:25

1 Answer 1

19

Your case is common in the corporate world, it is usually described as corporate MiTM. When you connect to the Internet from inside your network, you're likely connecting to a gateway/router the belongs to your company first. That router can simply hand you public key in a "fake" certificate whenever you connect to an SSL-enabled site and fool your browser into thinking it is the real website. Thus, making your SSL connection completely transparent.

Of course, when that happens, your browser should give you a warning that you're being handed a fake certificate. BUT, in a cooperate environment, you're likely given a company-owned computer and/or connecting to the company's Domain Controller, which gives the sysadmins enough access to install the company's fake certificate to the trusted root certificate store in your computer, which will suppress the browser's warnings.

Removing the certificate will likely disconnect you from other company services (the mail server, intranet websites, etc.). However, using an addon called Certificate Patrol, you'll be at least notified when that happens (somebody MiTMing your SSL connection), but it can't do anything about the attack.

You could VPN/SSH to your home network and use that to connect to the Internet, but chances are that they intercept that as well. There's really nothing you can do about it. They give you the Internet access, they can do whatever they want.

Bottom line is: Do work stuff at work, and personal stuff outside

2
  • Is there a Plugin for chrome too?
    – Hidden
    Commented Jun 17, 2013 at 14:42
  • @Polymorphin I'm unaware of any equivalent addon for Google Chrome. Perhaps others know something.
    – Adi
    Commented Jun 17, 2013 at 14:51

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .