Eventually we will find out enough about what the NSA can do that the entire internet is as good as screwed. If they can get away with MITM against just about any secure site then how does the internet economy function any more?
New NSA Leak Shows MITM Attacks Against Major Internet Services
81–90 of 149 posts
Re: New NSA Leak Shows MITM Attacks Against Major Internet Services
#82Holy shit. This means that The Netherlands was a high-level target with Diginotar, and they hit the frickin' jackpot. Just for reference, read this: http://nl.wikipedia.org/wiki/Hack_bij_DigiNotar The Diginotar hack basically exposed all of the information about the Dutch that NSA could ever want to digg through: Information about licenseplates (RDW) Tax info (DigiD) Phone records (OPTA) and the complete dutch encryp…
My understanding was DigiNotar was pretty strongly linked to an Iranian government affiliated hacker. Indeed, the breach was caught because someone man in the middled gmail in Iran and Chrome's certificate fingerprinting caught it. Although the NSA certainly has reason to spy on Iran, why risk discovery this way? They can legally compel Google to give them the email of foreigners in a foreign country. So maybe NSA ha…
Plant hackers in Iran (or just buy Iranian blackhats). Hack someone. If you're caught, blame the Iranians. Two birds, one stone.
Re: New NSA Leak Shows MITM Attacks Against Major Internet Services
#83This might also be an indication that their advances in attacking commonly used ciphers are not that major - it does not make that much sense to perform a relatively complex MITM attack if you are able to just break the used cipher.
Not so, active MITM is absolutely required if you want to get around PFS.
Re: New NSA Leak Shows MITM Attacks Against Major Internet Services
#84If this is true, and that NSA has been MITMing providers like Google, they are undermining the already shabby trust the US cloud-industry has attempted to build. I doubt Google and friends are very happy about that, since that's their one big basket where all the money comes in. NSA in their eagerness to do rampant spying on everyone have had quite some collateral. They have decided to compromise the one thing which…
The HSTS commits /maybe/ suggest that Google thinks a Verisign intermediate was signing MITMs for Google properties. They just blacklisted "VeriSignClass3SSPIntermediateCA" See: https://chromiumcodereview.appspot.com/23523051 Note that the associated bug is private ( https://code.google.com/p/chromium/issues/detail?id=173460 ). There's a good explanation of the "bad_static_spki_hashes" parameter here: http://ritter.v…
Raw decode of the cert that has been blacklisted.
http://pastebin.com/4wJXTsR4
Let the speculation begins.
Re: New NSA Leak Shows MITM Attacks Against Major Internet Services
#85If this is true, and that NSA has been MITMing providers like Google, they are undermining the already shabby trust the US cloud-industry has attempted to build. I doubt Google and friends are very happy about that, since that's their one big basket where all the money comes in. NSA in their eagerness to do rampant spying on everyone have had quite some collateral. They have decided to compromise the one thing which…
The HSTS commits /maybe/ suggest that Google thinks a Verisign intermediate was signing MITMs for Google properties. They just blacklisted "VeriSignClass3SSPIntermediateCA" See: https://chromiumcodereview.appspot.com/23523051 Note that the associated bug is private ( https://code.google.com/p/chromium/issues/detail?id=173460 ). There's a good explanation of the "bad_static_spki_hashes" parameter here: http://ritter.v…
[deleted]
Re: New NSA Leak Shows MITM Attacks Against Major Internet Services
#86Earlier quoted context omitted.
We have some large websites on board to deploy it, and Trevor has been working with browser vendors to get it integrated. The latter has been pretty slow going, but there is interest.
Maybe browser vendors will take it more seriously now, and with more urgency.
Especially one who's already had other services attacked. (Google)
Re: New NSA Leak Shows MITM Attacks Against Major Internet Services
#87Wait. They access google directly... without depend on routing your traffic and tramp your SSL to get a lot of compressed js and ajax traffic.
So... maybe this was only needed or relevant before have direct access ?
Re: New NSA Leak Shows MITM Attacks Against Major Internet Services
#88If this is true, and that NSA has been MITMing providers like Google, they are undermining the already shabby trust the US cloud-industry has attempted to build. I doubt Google and friends are very happy about that, since that's their one big basket where all the money comes in. NSA in their eagerness to do rampant spying on everyone have had quite some collateral. They have decided to compromise the one thing which…
This. In a recent post a commenter discussed how Bruce uses a machine not connected to any network ever for highly sensitive material. The problem with that is we really have no adequate indication of exactly what in all of this is really compromised. The conspiracy theorist in me suggests the whole of the internet in all its layers have been nurtured by our government. Exactly what part of that the NSA was involved in seems irrelevant. I have to wonder which operating systems, which network devices or any other devices that can run code and listen in.
The only advice if any of it were true would be to scrap it all and start over. Scrap multiple decades of work by really smart people due to a few "bad seeds" being planted during the harvest? Unfortunately that's the only true remedy unless someone can really unwind the rootkit in our lives that is the NSA. It's an analogy of a computer being infected with a virus. Do we try to go back to a backup we hope isn't compromised or do we reformat and start over? We're all trying the former because I don't think anyone really has a grasp on or even wants to think about the latter (I certainly don't).
Re: New NSA Leak Shows MITM Attacks Against Major Internet Services
#89Bucket Brigade is a better term for this kind of attack. Non-gendered speech and all.
Re: New NSA Leak Shows MITM Attacks Against Major Internet Services
#90Trevor Perrin and I have been working on a dynamic certificate pinning proposal called TACK to help mitigate these types of attacks: http://tack.io In the current state of the world, we're all dependent on CA signatures for each connection we make to a website. TACK is a layer of indirection away from CA certificates, such that we'd only be dependent on CA signatures the very first time we contacted a website. It doe…
A point worth making here: antisurveillance technology like TACK does more than make it harder for NSA to MITM TLS. As we've apparently discovered, it also makes it possible for us to detect TLS subversion. It is, right now, a major news story if someone has obtained a malicious root certificate; we need to know when that happens and to which CAs those certs chain (which is discoverable from the certificate).
If you don't pay much attention to how TLS works, you should know that NSA (presumably) does not have a magic ability to inject new certs into your root cert repository. If you remove every CA cert from your browser and selectively allow certs, they can't MITM that. The CAs aren't baked into TLS! They're a software configuration detail. And when MITM certs appear on the wire, for them to be honored, they have to somehow chain to a specific CA.
What things like pinning and TACK do is give us the opportunity to discover MITM certificates and start tracing them. If that capability becomes widespread enough, it can potentially foreclose on dragnet TLS MITM attacks, because there will be too much of a risk that deploying a dragnet MITM net will result in the death penalty for the implicated CA.
TACK (and the related efforts) are hugely more important than I think most people think they are. If you want to advocate for something in the wake of the NSA debacle, I think TACK is a great choice.