All Questions

Tagged with
-2
votes
1answer
72 views

Firewall can detect suspicious file over HTTPS [duplicate]

A firewall/router can intercept HTTPS traffic, analyse it and detect suspicious file download for example. From my understanding, it is acting as a proxy and/or a MITM device. If it is capable of ...
1
vote
0answers
64 views

What are the risks involved in blindly trusting all certificates for https requests over unknown proxy servers? [closed]

My use case is a Java application where no sensitive data being transmitted whatsoever, and the response being accurate (i.e. unmodified) is unimportant.
0
votes
1answer
136 views

Is my credit card information “wide open to hackers” without VPN?

I saw an ad for a vpn provider recently where they claimed that, without using a vpn, my credit card information is "wide open to hackers" while shopping on-line. I guess the implication here was that ...
-5
votes
1answer
242 views

Monitor SSL traffic at home

There is an underage guest in my house for whom I will be legally responsible for the next few months and I'm concerned about some of his interactions online from some of the public postings I've seen ...
0
votes
0answers
69 views

Meterpreter Over HTTPS Proxy

I have a proxy server on the WAN as well as my box open to the WAN. I want this proxy server to (when it receives a shell), route it to my host so it can be the "man in the middle" between my ...
0
votes
0answers
73 views

IP blocking and TLS v1.3's Encrypted SNI

It is my understanding that TLS's version 1.3 would prevent censors or any other middlebox entity from knowing the SNI field and hence know what is traveling on the network, or which particular ...
2
votes
1answer
111 views

Truly Disabling Session Tickets in Windows 10 Schannel

In windows 7, session tickets were disabled by disabling schannel cache, example: [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL] "EventLogging"=dword:00000004 "...
1
vote
1answer
925 views

OpenSSL - how to renew certificates in production?

Have a number of private network services deployed on different nodes outside of optionally encrypted mesh systems, like Docker or Consul. The services have high value and should communicate via TLS ...
1
vote
0answers
32 views

How should I secure my database in Microservice architecture

Can someone tell me whether I should secure may connections to the database from my microservice? Should I worry about the communication between my microservice and database?
2
votes
0answers
80 views

Decrypting DH traffic in DMZ

We have various servers in our DMZ's. Some of them are behind load balancers (but only few). We also have BlueCoat SSL Visibility Appliances currently deployed in passive-tap mode (we get the inbound ...
1
vote
1answer
655 views

Where exactly in the OSI model does TLS/SSL belong [duplicate]

I am trying to understand where exactly SSL/TLS sits in OSI model. If I look at this answer on StackExchange, While all network models are imperfect, this question can only be answered by looking ...
0
votes
1answer
1k views

Sniffing an outbound HTTPS packet - only intercepted by certain software, can't decrypt

I'm trying to sniff an SSL-encrypted outbound packet. It's sent by the game Mass Effect 3 to an EA web service. When I sniff packets with Nirsoft SocketSniff, I can see the packet (positively ...
3
votes
1answer
235 views

Why is TLS still commonly referred to as SSL? [duplicate]

I am developing in Visual Studio 2017 and I'm writing an asp.net core 2.0 web application. In the project properties there is a checkbox for Enable SSL. Any idea why this is called SSL instead of TLS? ...
1
vote
0answers
134 views

Is there any value to encrypting connections to localhost? [duplicate]

This is related to this question: Do I need to encrypt connections inside a network?, but I'm taking it a step further. We have an application that uses a lot of microservices that are hosted on the ...
2
votes
1answer
1k views

How does IPS terminate/decrypt encrypted traffic?

With regards to IPS, I am not completely across how they are supposed to terminate or decrypt encrypted traffic? It makes absolutely sense to deploy them inline, but how is traffic supposed to be ...
-8
votes
2answers
81 views

Securing our browsing history and data [duplicate]

Can our ISP's view our traffic and browsing data even when we are using HTTPS protocol? Is it the same for VPN? How can we secure our data from our ISP's?
1
vote
0answers
70 views

What additional protection required for authentication and messages sending in addition to TLS? [closed]

I use TLS for securing my client-server TCP communications. I have a Qt server and Android and iOS clients. For TLS connection I use only server side certificates, so only clients sure that they are ...
1
vote
1answer
218 views

Does TLS protocol make encryption at L2/L3 layers redundant?

If a pair of endpoints are using TLS protocol for secure data exchanges, does it make the encryption at the network or MAC layers redundant? E.g. if I create a TLS session between two endpoints ...
5
votes
3answers
90 views

How do I diagram a network node with multiple layers of trust?

If I'm communicating security and trust over a network, I might simply note trusted and untrusted nodes. For example, when making an HTTPS connection over some kind proxy node that I own and operate, ...
2
votes
1answer
141 views

How does a “fake” network-adapter steal credentials?

I've read that devices that look like USB flash drives can be hidden network cards that can then steal credentials even when the screen is locked. (Like the Bash Bunny) I understand that being the ...
1
vote
3answers
665 views

Number of bytes in a TLS handshake

How can I identify precisely the exact number of bytes the ClientHello and ServerHello in a TLS traffic needs? this is for traffic analysis purpose to capture the TLS bytes of interest (client hello ...
-1
votes
1answer
743 views

Do I need SSL/TLS for TCP

It might sound stupid but I could not find the straight answer. Do I need to worry about communication security if I use only TCP socket to communicate between 2 machines? Is the byte stream can be ...
4
votes
1answer
131 views

Circumventing Netflow's visibility on SSL traffic

In a SSL handshake, the hostname is visible most of the time as it is needed to validate the certificate over HTTP. Netflow is thus able to pick up the common name from the certificate exchange, ...
1
vote
1answer
176 views

Can malicious communication be hidden reasonably well in encrypted network traffic?

Given that a lot of websites now use TLS/https to encrypt all network traffic: If a client machine is compromised and does need to establish a back channel to a C&C-Server for additional ...
3
votes
3answers
123 views

Organisation's use of SSL inspection and duplication of root CA certs

An organisation (a school in this example) requires connecting personal devices to install root CA certs to allow SSL inspection to occur. Whether is this ethical or unethical is another issue - in ...
2
votes
3answers
401 views

How to prevent users from downloading executable files or portable apps?

Is it possible to prevent executables or portable apps from being downloaded in a corporate environment on the network layer? (i.e not some agent on a host preventing it) Would this require MITM SSL ...
0
votes
5answers
380 views

Why are ‘unsecure networks’ still a thing in the age of HTTPS? [closed]

We have robust cryptosystems that are pretty good at ensuring privacy and integrity of messages, and we have widespread communications protocols to implement them. Nowadays, virtually any serious ...
9
votes
1answer
752 views

Does the TLS 1.0 support on CloudFront create a vulnerability when only TLS 1.2 is enabled on the Origin side?

We currently host our website on AWS with CloudFront. CloudFront currently does not support disabling TLS 1.0 or 1.1 on the Viewer side. It only provides support for limiting access to TLS 1.2 on the ...
3
votes
2answers
730 views

How insecure is it to use the same private key for multiple x509 certificates?

My (bring your own device) school has recently implemented TLS interception for search engines and Youtube. We all installed a root certificate as a "Trusted Root CA." Taking a look at the fake ...
0
votes
1answer
136 views

Connect to HTTPS through untrusted proxy [duplicate]

As far as I know, and please correct me if I'm wrong, I can connect to an https site (assuming the whole page is https) while using a free proxy server I find on the web (and entered into Firefox's ...
0
votes
3answers
669 views

Best options for SSL inspection while maintaining Perfect Forward Secrecy

We are looking to monitor inbound HTTPS connections for performance issues as well as errors. HTTP requests we are able to gather this information just fine, but we don't have a way to do this while ...
4
votes
1answer
2k views

TLS- Concept of channel binding

TLS-Handshake is based on public-key cryptography for symmetric key exchange, pki for server-authentication and assume the user authentication is realized trough username and password in the ...
4
votes
1answer
1k views

WebRTC security & encryption

I am building a WebRTC application, and really concerned about security. I have read this quite interesting article : https://webrtc-security.github.io As I am far from being an expert in networking ...
0
votes
1answer
538 views

How to sniff ECDH HTTPS traffic?

Our company currently sniffs encrypted RSA traffic using a network tap. Would this still be possible using ECDH? I guess not. Are there commercial alternatives, like placing an agent on the ...
2
votes
2answers
28k views

Enable TLS on SQL Server

I am familiar with implementing SSL encryption for data in transit by including "Encrypt=True" to the connection string and adding a certificate in SQL Server Configuration Manager for the instance in ...
4
votes
3answers
288 views

I just found out I have unknowingly been sending a password not using SSL, how likely is it that I have been compromised?

I just realized that I have been connecting (sending user name and password) to my production MongoDB database for several weeks using MongoChef (a database GUI) without the SSL option enabled. I ...
1
vote
3answers
1k views

SSL for private network

I have a private network, a VPS, an Apache web server and several web pages. Most documentation about SSL configuration state that I should buy a certificate, and should give the website adress. ...
0
votes
4answers
242 views

Is it possible for our security administrator to still see our packets from the server side?

This question may be confusing by it's title. My main question is, if it's possible for a Security Administrator to view encrypted packets sent to an HTTPS website? In present or past. I work at a ...
0
votes
1answer
1k views

Best option for DDoS protection on DigitalOcean server?

I would not like to use CloudFlare since they effectively act as a man in the middle and handle unencrypted data. Is there a CDN that mitigates the security risks that CloudFlare imposes? If not, is ...
3
votes
3answers
2k views

Is SSL Interception possible without disabling Public Key Pinning on the client side?

I'm currently setting up a pfSense firewall in my lab. It supports SSL Inception which works pretty well for most sites. But there are some sites which use HTTP Public Key Pinning to prevent MitM ...
-3
votes
1answer
103 views

is SSL/TLS certificate vulnerable

To my understanding, the client verifies the server certificate by checking whether the issuer DN (Distinguished Name) is equal to the subject DN in the root certificate ? If this is the case, anyone ...
3
votes
1answer
179 views

Authenticate tracking device with TCP server

I am building a tracking device and am looking for a secure authentication method to use when the device wants to establish a connection to the server. The server is a TCP server that we open a ...
1
vote
1answer
4k views

Is it possible to utilize an outbound proxy to upgrade to TLS

Given a situation where legacy technology exists from a system and we don't want to do a complete upgrade (.net in this case w/ version that doesn't have any support for TLS 1.1/1.2) as the product ...
2
votes
1answer
89 views

Password sent over TLS: threats other than TLS compromise?

One of my findings during a security audit was a password, sent as is over the network. As bad as it sounds, this happens only over HTTPS connection. Some authors suggested here that additional ...
1
vote
4answers
672 views

Which of the TLS/SSL and IPsec protocols is effective?

Which of those two protocols is the most effective for sending data from a client to a server on a local network (knowing that I aim to use it for FTP traffic)?
56
votes
3answers
6k views

Is it common practice for companies to MITM HTTPS traffic?

My company has just introduced a new VPN policy whereby once connected all traffic is routed the company network. This is to allow for improved monitoring of data theft. It would appear that this ...
0
votes
1answer
519 views

Network security question (NLB and 2-way TLS) [duplicate]

I have a situation that can be better illustrated in the network diagram below. My scenario: Client Web Server (external party) is using TLS 1.2. In my network, My Web Server is fronted by a NLB (...
3
votes
1answer
310 views

Is it possible to maintain security and data integrity through a network decrypting HTTPS?

A network I often use has started to decrypt HTTPS traffic (and reencrypt, using a different key) using a local proxy. This proxy is operated by people I mostly trust. However, I would like to know if ...
-2
votes
1answer
73 views

A collection of tests and demos for security headers and TLS configurations [closed]

There are (or have been) various websites designed to educate and provide examples on good / bad configurations of security headers and TLS configurations (e.g. https://badssl.com/) I want to build a ...
0
votes
2answers
266 views

Sniffing TLS / SSL through HSTS?

Imagine the following: Client C wants to communicate with server S. The evil attacker A is the Man-In-The-Middle. C sends a request to S, A intercepts it. A creates a self-signed certificate with ...