The enterprise where I work has a proxy server that traces and filters our web activities. Employees claim that they can know the links that we visited and see the content of HTTP web sites, but they can't see the content of HTTPS secured web sites because the content would be encrypted by the server. I don't share the same idea and I think that there are plenty of ways to access the HTTPS content.

Could someone give me some type of attacks that could let them access the content of our HTTPS secured navigation or hijack our sessions?

Just guessing: One of the things that could increase the risk that they can execute a MITM attack as the image shows is the fact that they give a preinstalled Windows XP/7 system to new employees so they can install malicious certificates to these computers and make them trust additional Certification authorities Figure


The graphic you posted is a setup which isn't actually that uncommon in corporations. It allows the intercepting proxy server to eavesdrop and even modify any web activity. Legitimate use of this technique is usually to enforce acceptable use policies in the organization, like preventing people from playing games or looking at porn while they should be working. It also allows to scan any traffic for web-based exploits or viruses before they reach the client. With end-to-end encryption, this would be impossible for the proxy.

However, should a network administrator really have malicious intentions, they could, for example, snoop any usernames and passwords people enter on any website. They could also redirect websites to their own servers without the user noticing and give them false information or luring them into entering information the legitimate website isn't asking them for.

But let's assume they don't use this setup and the end-to-end encryption between client and webserver works as they believe. What other information can be logged on the proxy? While the proxy doesn't know the exact URLs you visited, it still knows which domains you contacted. So it doesn't see http://reallypervertedporn.example/videos/167642/hot_girl_on_girl_on_guy_on_goat_action_part4.flv but it still sees that you made a TLS-handshake with https://reallypervertedporn.example and received several MB of data, which might be something you have to explain.

| improve this answer | |
  • Yep, some corporations do install their own CA certificates on company machines. Realistically if it's their machine and you consider them an adversary there's nothing you can do about it any way. They could just install monitoring software on the actual machine or in the browser for example. – thexacre Jun 1 '14 at 0:38
  • 1
    @SnakeHernandez I realized I dodged your question a bit. I added an additional paragraph which explains what an admin could do without an intercepting proxy. – Philipp Jun 1 '14 at 12:47

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.