Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

BlueCoat and other proxies hang up during TLS 1.3

bugs.chromium.org

Post reply on HN
Print view View original

71–80 of 216 posts

Re: BlueCoat and other proxies hang up during TLS 1.3

#71

Post by fulafel »

wildmusings wrote: post #22
db48x wrote: post #10

The long-term solution is simply not to work anywhere that insists on running a MITM attack on all of your communications.

Without an SSL MITM, Intrusion Detection Systems (IDS's) are much less effective. If you're using your company's network, then they have every right to monitor all of the activity on it. They're trying to protect trade secrets, future plans, customer data, employee records, etc. from attackers who would use that information to do harm to the company, its customers, and its employees. If you don't want your employer t…

Bad generalization - in many countries, it's illegal for your company to do content inspection.

There's a good argument that it's unethical too. There are many ways where your company has to trust you instead of pervasively monitoring your doings and communications, and this should fall in the same area.

Re: BlueCoat and other proxies hang up during TLS 1.3

#72

Post by zrm »

theluketaylor wrote: post #68
zrm wrote: post #54

Earlier quoted context omitted.

> If you're using your company's network, then they have every right to monitor all of the activity on it. It isn't a question of whether they're allowed to do it, it's a question of whether they should do it. It's ineffective against insider exfiltration of data unless you're also doing body cavity searches for USB sticks, and if you're at that point then the sensitive network should not be connected to the internet…

>It's ineffective against insider exfiltration of data unless you're also doing body cavity searches for USB sticks, and if you're at that point then the sensitive network should not be connected to the internet at all. We opted to disable usb mass storage since cavity searches seemed a little much

> We opted to disable usb mass storage since cavity searches seemed a little much

This is missing the point. Someone could plug a SATA drive directly into the motherboard, or otherwise compromise their work computer to disable the restrictions, or take pictures of documents with a camera, or bring their own computer on-site, or bring a line-of-sight wireless network device on-site, or send the data over the internet as an encrypted file or via ssh or using steganograhy and so on.

The point is that preventing data exfiltration is not a trivial task, and if you're at all serious about it then the network containing the secrets is not connected to the internet. And if it's less serious than that then it can't justify a high-risk TLS MITM device.

Re: BlueCoat and other proxies hang up during TLS 1.3

#73

Post by semi-extrinsic »

rossy wrote: post #52
wildmusings wrote: post #22

Earlier quoted context omitted.

Without an SSL MITM, Intrusion Detection Systems (IDS's) are much less effective. If you're using your company's network, then they have every right to monitor all of the activity on it. They're trying to protect trade secrets, future plans, customer data, employee records, etc. from attackers who would use that information to do harm to the company, its customers, and its employees. If you don't want your employer t…

I think this SSL MITM thing has gone way too far. When an exec asks an engineer if it's possible to monitor all internet communication that goes in and out of the company network, including communication that is encrypted by TLS, the correct answer is no. In fact, this specific thing is what TLS is designed to prevent, and new implementations of the protocol are only going to get better at preventing it. The exec wil…

> still doesn't protect you against (...) malware written by people who have SSL MITM proxies in mind

Exactly this is what I don't get. Since these abominations are becoming ubiquitous, surely malware writers are starting to work on workarounds? And in this case, it's as easy as setting up an SSH tunnel and running your malware traffic through that, which is a few days of work at best for a massive ROI?

Re: BlueCoat and other proxies hang up during TLS 1.3

#74

Post by wildmusings »

rossy wrote: post #52
wildmusings wrote: post #22

Earlier quoted context omitted.

Without an SSL MITM, Intrusion Detection Systems (IDS's) are much less effective. If you're using your company's network, then they have every right to monitor all of the activity on it. They're trying to protect trade secrets, future plans, customer data, employee records, etc. from attackers who would use that information to do harm to the company, its customers, and its employees. If you don't want your employer t…

I think this SSL MITM thing has gone way too far. When an exec asks an engineer if it's possible to monitor all internet communication that goes in and out of the company network, including communication that is encrypted by TLS, the correct answer is no. In fact, this specific thing is what TLS is designed to prevent, and new implementations of the protocol are only going to get better at preventing it. The exec wil…

>In fact, this specific thing is what TLS is designed to prevent, and new implementations of the protocol are only going to get better at preventing it.

This isn't true. The TLS protocol is not a philosophy; it does not have an opinion on who you should trust as a root certificate authority. If you trust a particular root, it is wholly within the design of TLS to allow connections that are monitored by whoever controls that root authority. Who is trusted is up to you.

>They may or may not mention that if they do it wrong it will degrade the security of everything on the network.

Right, that's why you don't do it wrong. This same argument applies for any monitoring technology, like cameras. An insecure camera system actually helps a would-be intruder by giving them valuable information. So if you install cameras, you'd better do it right.

As for your list of ways such a system could be circumvented, I don't understand the logic of it. So because there are ways around a security measure, you shouldn't use the security measure at all? There is no security panacea, just a wide range of imperfect measures to be deployed based on your threat model and resources. And luckily, most bad guys are pretty incompetent. But to address some examples you give, and show how not all is lost:

- A large encrypted zip file is sent out of the network. Depending on what your concerns are, that could be a red flag and warrant further analysis of that machine's/user's activity.

- Software trying to circumvent your firewall/IDS is definitely a red flag. You might even block such detected attempts by default, and just maintain a whitelist for traffic that should be allowed regardless (e.g. for approved apps that use pinned certificates for updates).

Re: BlueCoat and other proxies hang up during TLS 1.3

#75

Post by semi-extrinsic »

theluketaylor wrote: post #67
FireBeyond wrote: post #60

Earlier quoted context omitted.

> but no corporate data can be moved en mass off company servers. How so? 1. Connect to Corp Wifi 2. git clone companyapp.git 3. Connect to Employee Personal Wifi 4. Email tgz'ed companyapp ?

When connecting a corporate device to any non-corporate network (including the employee wifi) you can't go anywhere until the vpn is connected. The vpn routes you through all the same inspection points as being on premise.

Is both SSH and USB key / USB DVD burner usage completely disabled on your corporate devices? If not, obvious workaround is obvious.

Re: BlueCoat and other proxies hang up during TLS 1.3

#76

Post by buzer »

theluketaylor wrote: post #67
FireBeyond wrote: post #60

Earlier quoted context omitted.

> but no corporate data can be moved en mass off company servers. How so? 1. Connect to Corp Wifi 2. git clone companyapp.git 3. Connect to Employee Personal Wifi 4. Email tgz'ed companyapp ?

When connecting a corporate device to any non-corporate network (including the employee wifi) you can't go anywhere until the vpn is connected. The vpn routes you through all the same inspection points as being on premise.

So you cannot access the portal page that quite a few more or less public wifi networks require you to access in order to gain internet access?

Re: BlueCoat and other proxies hang up during TLS 1.3

#77

Post by wildmusings »

semi-extrinsic wrote: post #73
rossy wrote: post #52

Earlier quoted context omitted.

I think this SSL MITM thing has gone way too far. When an exec asks an engineer if it's possible to monitor all internet communication that goes in and out of the company network, including communication that is encrypted by TLS, the correct answer is no. In fact, this specific thing is what TLS is designed to prevent, and new implementations of the protocol are only going to get better at preventing it. The exec wil…

> still doesn't protect you against (...) malware written by people who have SSL MITM proxies in mind Exactly this is what I don't get. Since these abominations are becoming ubiquitous, surely malware writers are starting to work on workarounds? And in this case, it's as easy as setting up an SSH tunnel and running your malware traffic through that, which is a few days of work at best for a massive ROI?

Depending on the threat model and how serious you are about locking things down, you might just block all such traffic.

Re: BlueCoat and other proxies hang up during TLS 1.3

#78

Post by bradleyjg »

bgc wrote: post #30
x1798DE wrote: post #25

Earlier quoted context omitted.

They should lobby the school board not to do this nonsense.

The Board doesn't have a choice, under CIPA[0], content filtering is a requirement for the FCC's E-Rate program[1] in which the government pays some of the cost of the school's internet connection. [0] https://www.fcc.gov/consumers/guides/childrens-internet-prot... [1] https://www.fcc.gov/general/universal-service-program-school...

>> content filtering is a requirement for the FCC's E-Rate program in which the government pays some of the cost of the school's internet connection.

I'd be interested to see the cost of compliance versus the subsidy. The federal government puts an awful lot of strings on financing for schools given the relatively low percentage of overall funding they pay.

I'd like to see some state somewhere turn down the money and see what they can do with the extra flexibility.

Re: BlueCoat and other proxies hang up during TLS 1.3

#79

Post by jlgaddis »

quotemstr wrote: post #4
JoshTriplett wrote: post #2

Note that this happens even when using a BlueCoat proxy in non-MITM mode. BlueCoat tries to "analyze" TLS connections, and rejects anything it doesn't understand. This exact issue occurred with TLS 1.2 back when BlueCoat only understood 1.1/1.0. In this case, it doesn't sound like they're reverting it because of overall breakage, but rather because it breaks the tool that would otherwise be used to control TLS 1.3 tr…

Ridiculously conservative middleboxes are why we can't have nice things and why we need to encrypt all new protocols, security properties aside.

[ off-topic comment deleted ]

Re: BlueCoat and other proxies hang up during TLS 1.3

#80

Post by habitue »

acdha wrote: post #28
x1798DE wrote: post #25

Earlier quoted context omitted.

They should lobby the school board not to do this nonsense.

Think about how that conversation would go. They're driven by concerns that kids will look at porn – and remember that if they don't try to stop that, the local Fox News applicate will be running a loop 24x7 saying they're trying to force godly children to watch it – or that someone will breach a staff member's computer and steal PII, compromise the security cameras, etc. Against that, making life hard for Chrome eng…

Just an FYI, local fox affiliates don't have the ideological bent of the cable station. They're often run by entirely different companies
Post reply on HN