Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

New NSA Leak Shows MITM Attacks Against Major Internet Services

schneier.com

Post reply on HN
Print view View original

41–50 of 149 posts

Re: New NSA Leak Shows MITM Attacks Against Major Internet Services

#41

Post by dingaling »

peterwwillis wrote: post #21

Some firefox add-ons to help defend against mitm: Certificate Patrol (notifies you when certs change) https://addons.mozilla.org/en-us/firefox/addon/certificate-p... Force-TLS (force websites to always use HTTPS) https://addons.mozilla.org/en-us/firefox/addon/force-tls/ Perspectives (compare certs with peers to verify authenticity) https://addons.mozilla.org/en-us/firefox/addon/perspectives/

> Some firefox add-ons to help defend against mitm:

In theory yes, but not more than 10 minutes ago Cert Patrol noticed that Amazon have changed the CA for the SSL cert for an image server.

What am I supposed to do? It is interesting info, but if I reject the cert then I can't be sure my connection is secure. If I accept it... I can't be sure my connection isn't MiTMed.

The human factor is always the weak link.

Re: New NSA Leak Shows MITM Attacks Against Major Internet Services

#42

Post by [deleted] »

peterwwillis wrote: post #21

Some firefox add-ons to help defend against mitm: Certificate Patrol (notifies you when certs change) https://addons.mozilla.org/en-us/firefox/addon/certificate-p... Force-TLS (force websites to always use HTTPS) https://addons.mozilla.org/en-us/firefox/addon/force-tls/ Perspectives (compare certs with peers to verify authenticity) https://addons.mozilla.org/en-us/firefox/addon/perspectives/

[deleted]

Re: New NSA Leak Shows MITM Attacks Against Major Internet Services

#43

Post by anologwintermut »

SchizoDuckie wrote: post #11

Holy shit. This means that The Netherlands was a high-level target with Diginotar, and they hit the frickin' jackpot. Just for reference, read this: http://nl.wikipedia.org/wiki/Hack_bij_DigiNotar The Diginotar hack basically exposed all of the information about the Dutch that NSA could ever want to digg through: Information about licenseplates (RDW) Tax info (DigiD) Phone records (OPTA) and the complete dutch encryp…

My understanding was DigiNotar was pretty strongly linked to an Iranian government affiliated hacker. Indeed, the breach was caught because someone man in the middled gmail in Iran and Chrome's certificate fingerprinting caught it.

Although the NSA certainly has reason to spy on Iran, why risk discovery this way? They can legally compel Google to give them the email of foreigners in a foreign country.

So maybe NSA had DigiNotar's key, but the hack that shut it down was done by someone else.

Re: New NSA Leak Shows MITM Attacks Against Major Internet Services

#44

Post by lambda »

josteink wrote: post #20

If this is true, and that NSA has been MITMing providers like Google, they are undermining the already shabby trust the US cloud-industry has attempted to build. I doubt Google and friends are very happy about that, since that's their one big basket where all the money comes in. NSA in their eagerness to do rampant spying on everyone have had quite some collateral. They have decided to compromise the one thing which…

Didn't the slides show that it was the Diginotar compromise?

> We cannot have untrustworthy CAs in a system based on trust. That's simply not an option.

The entire CA trust model is broken. In the trust model, any CA can issue certs for any domain; so a Chinese CA could issue Google certs, or a US CA could issue certs for the Dutch government.

Self-signed certs with certificate pinning are indeed more likely to be secure than CA certs. Of course, you can do both; CA signed certs (which does add a small amount of trustworthiness, as the CA is at least supposed to do a little work to verify a real-world identity), and use certificate pinning to avoid this kind of attack.

Re: New NSA Leak Shows MITM Attacks Against Major Internet Services

#45

Post by anologwintermut »

jlgaddis wrote: post #39
anologwintermut wrote: post #31

I'd say this is likely bullshit at least that it was done against a Brazilian company. Why take the risk of getting caught and burning your ability to do this when you can get the information from Google? 1) Chrome(and some plugins) pin's certificates and would notice a man in the middle attack(unless it was done with google's key). Sure, most corporate targets probably use IE, but if anyone uses chrome on or one of…

I believe Chrome only "pins" certain certificates and almost certainly doesn't pin every SSL certificate you may happen to come across -- this is what the EFF's Observatory[0] and browser plugins like Certificate Patrol[1] are for -- although I may very well be wrong on that. Also, a March 2010 research paper by Christopher Soghoian and Sid Stamm "in which they present evidence that certificate authorities (CAs) may…

I think it pin's google's certificates. The article claims The goal of the attack was to "impersonate Google security certificates."

I'm not saying NSA doesn't have the ability, just the implication that it was used against Brazil is likely wrong.

Re: New NSA Leak Shows MITM Attacks Against Major Internet Services

#46

Post by dictum »

mcphilip wrote: post #37
fejr wrote: post #36

Weird. This has been submitted in less than two hours, has 90 points, but it is at the bottom of the front page. Other stories from 6+ hours ago with less points are at the top.

This has been the case for nearly all NSA related stories in the past week. There is a lot of flagging going on. I'd be interested in a data dump of who is doing the flagging and getting an idea if it's an indicator that the HN community as a whole doesn't want these stories or if it's just a small, but vigilant subset.

https://news.ycombinator.com/item?id=6369530

Re: New NSA Leak Shows MITM Attacks Against Major Internet Services

#47

Post by lambda »

anologwintermut wrote: post #43
SchizoDuckie wrote: post #11

Holy shit. This means that The Netherlands was a high-level target with Diginotar, and they hit the frickin' jackpot. Just for reference, read this: http://nl.wikipedia.org/wiki/Hack_bij_DigiNotar The Diginotar hack basically exposed all of the information about the Dutch that NSA could ever want to digg through: Information about licenseplates (RDW) Tax info (DigiD) Phone records (OPTA) and the complete dutch encryp…

My understanding was DigiNotar was pretty strongly linked to an Iranian government affiliated hacker. Indeed, the breach was caught because someone man in the middled gmail in Iran and Chrome's certificate fingerprinting caught it. Although the NSA certainly has reason to spy on Iran, why risk discovery this way? They can legally compel Google to give them the email of foreigners in a foreign country. So maybe NSA ha…

Or perhaps the Iran link was a misdirection. They were worried that people would notice the MITMed certs, so they MITMed a lot of Iranian customers to make it look like the attack came from there.

> They can legally compel Google to give them the email of foreigners in a foreign country.

They can, but they may wish to be more subtle than that. For example, if they were engaged in economic espionage, they might not want that story to break, and would be worried that someone at Google may leak the story. If they had to ask Google, there would be more people who would know about what's going on.

Re: New NSA Leak Shows MITM Attacks Against Major Internet Services

#48

Post by einaros »

anologwintermut wrote: post #31

I'd say this is likely bullshit at least that it was done against a Brazilian company. Why take the risk of getting caught and burning your ability to do this when you can get the information from Google? 1) Chrome(and some plugins) pin's certificates and would notice a man in the middle attack(unless it was done with google's key). Sure, most corporate targets probably use IE, but if anyone uses chrome on or one of…

Where did you read that it's mail traffic they were after? I'm beginning to strongly believe that it's Google's other services are considered for use in specific attacks.

Imagine if some foreign service, that is outside of an NSL's reach, has communication that the NSA wants to snoop on. If they can't break the crypto, but that service happens to load jQuery off of Google's CDN, or use Google Analytics, the NSA could pull a MITM attack and manipulate the content of the requested scripts.

Those scripts could rather easily act as proxies for the NSA or others, and either hijack sessions or pull data straight out of the protected services.

I'm tooting my own horn here, but that's exactly the kind of thing this blog post speculates on: https://2x.io/read/would-the-nsa-infiltrate-cdns-to-circumve...

Re: New NSA Leak Shows MITM Attacks Against Major Internet Services

#49

Post by jlgaddis »

lambda wrote: post #44
josteink wrote: post #20

If this is true, and that NSA has been MITMing providers like Google, they are undermining the already shabby trust the US cloud-industry has attempted to build. I doubt Google and friends are very happy about that, since that's their one big basket where all the money comes in. NSA in their eagerness to do rampant spying on everyone have had quite some collateral. They have decided to compromise the one thing which…

Didn't the slides show that it was the Diginotar compromise? > We cannot have untrustworthy CAs in a system based on trust. That's simply not an option. The entire CA trust model is broken. In the trust model, any CA can issue certs for any domain; so a Chinese CA could issue Google certs, or a US CA could issue certs for the Dutch government. Self-signed certs with certificate pinning are indeed more likely to be se…

DANE[0] (in combination w/ DNSSEC[1]) is starting to sound really good right about now... except that, you know, the U.S. also runs several root nameservers.

[0]: https://tools.ietf.org/html/rfc6698 [1]: https://en.wikipedia.org/wiki/Domain_Name_System_Security_Ex...

Re: New NSA Leak Shows MITM Attacks Against Major Internet Services

#50

Post by jlgaddis »

chopin wrote: post #5

The documents mention the DigiNotar hack explicitly. What I do not understand is that the hack was detected when (afair) Iranian authorities tried to MITM Google connections, so the hack was claimed to come from an Iranian hacker. This begs the question whether this is wrong and the NSA hacked DigiNotar genuinely or they just used the breach (perhaps then only known to them) to fake certificates themselves. One may a…

If memory serves, the Internet in Iran is state-controlled. While it was a user in Iran who initially discovered the MITM'ing being performed and the obvious assumption is that it was the Iranian government MITM'ing its citizens, it is also quite possible that it was (e.g.) the NSA MITM'ing (everyone|a group of people) in Iran (possibly attempting to MITM connections from Iranian officials/nuclear power plants/etc.).
Post reply on HN