5

There are some wifi networks (large universities for example) which use HTTPS to get to a login page, and in order to verify that they have not been spoofed, provide the certificate ahead of time (i.e. from the companies official website, using SSL, which you are supposed to have accessed & downloaded ahead-of-time).

Now, assuming I followed their instructions and installed this cert (I can't seem to find a good example, it seems many use an exe tool instead that installs the certs into the system), I can log into their HTTPS captive portal and gain internet access - but would it be secure? how can I know that they aren't using the cert that they asked me to install to snoop on all HTTPS traffic? (aside from manually checking the certs for each website)? can I limit what domains their cert is valid for?

P.S. - it may be possible to access the page without the cert, after ignoring the big red text displayed by a browser, but then the risk is transferred to avoiding spoof networks by manually inspecting.. the same cert - question is more aimed at the vulnerability of those less tech savvy who simply follow the instructions as-is.

  • 2
    So basically they're too cheap to buy a cert and expect you to work around that? What are their official instructions what you are supposed to do and why? Can you give a link? -- That being said, firefox allows you to add exceptions on a page-by-page basis. Is that an option for you? – StackzOfZtuff Jun 28 '15 at 15:35
  • @StackzOfZtuff stuff like these instructions and this "don't install it workaround" - I don't see any "download certificates" anymore, as they seem to have migrated to using "tools" that install the certificates instead, but I don't think this helps the security (or rather may make it worse) – user2813274 Jun 28 '15 at 15:49
  • @StackzOfZtuff found some certificates (it's translated from Italian) - but their instructions seem to have changed and no longer say to install the certificates, and simply ignore that field – user2813274 Jun 28 '15 at 15:56
2

Most large networks will use a firewall or proxy to perform web content filtering. HTTPS pages can cause issues as the data on the page is encrypted. So I would assme that the pages that give you a red error are HTTPS pages. The reason for this is because the firewall acts as the client and decrypts the page to check it for viruses and against the network policy and then serves you the page under its own self signed certificate.

A large University should be safe however it is up to you as they are effectly decrypting the data so they could read your passwords and data etc. However there are laws to prevent this.

  • Most firewalls these days do use HTTPS decryption, such as Sophos UTM 9 - XG, Palo Alto, WatchGaurd etc. Hense why I put / Proxy Firewall. This should help explain how it works – Jake M Jan 19 '17 at 15:33
  • Hmm... I still believe that you should not call it a firewall. It is a TLS proxy, it simply resides on a router hardware that is making the firewall too. – grochmal Jan 19 '17 at 15:46
  • Most proxy's are built into the firewall now and most company's are now developing UTM (unified Threat Management) solutions which compile firewall, proxy, application control and even antivirus into one solution so there is a possibility that the University is using something like this. – Jake M Jan 20 '17 at 12:03
  • I still disagree in calling it a firewall. Seems like promoting a business practice. I have killed the first comment since it isn't that relevant anymore. But maybe I can convince you to change the name to UTM (and explain what it is). Or maybe "firewall hardware" would work too. When you seem "firewall" here on sec.SE you think layer 2 and 3 filtering. – grochmal Jan 20 '17 at 19:22
  • "A large University should be safe"? I don't buy that for a second. An MITM machine at the university (or even just it's certificate) would be a deliciously plump target. The very concept suggests bad administration and misuse from the outset. Assume the worst. – spender Mar 20 '17 at 23:01
0

Let's divide. You are using a kind of client certificate authentication that gives you access to Wi-Fi gateway. This certificate is just for that purpose. Normally, in this case, certificate is being checked for the correct chain and validity - nothing else.

As for HTTPS trafic, going out from your PC. The point is, that if you installed the certificate as a Trust, now the gateway can send you encrypted trafic that is being signed by this CA and will be considered as Trusted by your computer. This is classic SSL-bumping MITM attack, where the attacker injects its root CA as Trust and then signs all incoming SSL trafic by this certificate, where genuine encryption was "opened" on the proxy. You can always check certificate chain by clicking on the locker icon in your browser and check signing authority. Basicly, if you installed any certificate - it has pre-defined issuer and domain data. So, you can easily see if your connection certificate was signed by this fake authority.

In any case. If you see "red flag" after refusing certificate installation - it means that the gateway for sure bumps original ssl connection and give you fake certificate. It is really unsafe. And it does not matter if you installed the certificate or not - all of them will be changed inside this network.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.