3

I am doing a penetration test at the moment, where the client has deep packet inspection for SSL enabled (my guess), as every SSL connection seems to being MITMed.

Now, some HTTPS sites, like Gmail, throw up a warning about the site not being trusted. Which is expected. Other sites however, such as Yahoo Mail, are not being MITMed, as the certificate shows that it belongs to Yahoo and signed by VeriSign.

So, does this mean only particular sites are chosen to intercept (which would be very odd given the mix of sites that give a warning and ones that do not), or that there is a way to fool the browser?

I'm thinking the former, but don't want to rule out the latter in case there is something I'm not aware of.

2

While it is possible that it is a technique to fool the browser I would seriously doubt it.

The vast majority of products I've dealt with that provide deep inspection only provide a single root certificate from under which all of the SSL inspection is executed. While it isn't definitive my leaning would be to say that anything that isn't using the known inspection root is being passed without inspection.

I personally don't find it all that unusual to get a big mix of sites that have deep inspection disabled. It seems that 3/4 of the helpdesk tickets that get escalated to me have to do with disabling HTTPS inspection.

  • I figured, but wanted to make sure. Just an odd policy of what gets passed through or not I guess. Thanks. – Sonny Ordell Jul 24 '14 at 15:54

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.