Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

New NSA Leak Shows MITM Attacks Against Major Internet Services

schneier.com

Post reply on HN
Print view View original

51–60 of 149 posts

Re: New NSA Leak Shows MITM Attacks Against Major Internet Services

#51

Post by jlgaddis »

peterwwillis wrote: post #25
Nanzikambe wrote: post #23

Earlier quoted context omitted.

One thing the leaks have reveal is that the NSA invested significant effort in compromising/backdooring hardware . Now if I were intent on compromising hardware to increase my reach, my prime targets are going to be the makers of routing & switching hardware. Someone like Cisco perhaps. Do you have any idea how many such hardware blackboxes lie between any two locations on the net? All that would be needed is a singl…

When you start going down that line of reasoning, virtually every chip in every computer in the world "could" be backdoored. Again, the costs and technical challenges of doing this wholesale across a long line of products across many hardware vendors is practically impossible. I'd be more worried using Huawei gear, anyway.

At this point I might just feel more secure running Huawei gear (as I type this at home on a Lenovo Thinkpad connected to an Aerohive access point plugged into a Cisco ASA firewall).

Re: New NSA Leak Shows MITM Attacks Against Major Internet Services

#52

Post by taway2012 »

anologwintermut wrote: post #31

I'd say this is likely bullshit at least that it was done against a Brazilian company. Why take the risk of getting caught and burning your ability to do this when you can get the information from Google? 1) Chrome(and some plugins) pin's certificates and would notice a man in the middle attack(unless it was done with google's key). Sure, most corporate targets probably use IE, but if anyone uses chrome on or one of…

AFAIK, Chrome "certificate pinning" may not exactly be what you think "certificate pinning" means. It should be more precisely called "certificate authority pinning". What it means is that Chrome will not trust certs for Google properties except those issued by certain certificate authorities. Reference: https://www.imperialviolet.org/2011/05/04/pinning.html

Unless things changed since I last checked.

In contrast, "real" "certificate pinning" as done in some mobile apps (IIRC Twitter) involves storing the hash of the certificate itself in the app. No other certificate, even from the same CA, will be accepted.

Re: New NSA Leak Shows MITM Attacks Against Major Internet Services

#53

Post by jlgaddis »

anologwintermut wrote: post #45
jlgaddis wrote: post #39

Earlier quoted context omitted.

I believe Chrome only "pins" certain certificates and almost certainly doesn't pin every SSL certificate you may happen to come across -- this is what the EFF's Observatory[0] and browser plugins like Certificate Patrol[1] are for -- although I may very well be wrong on that. Also, a March 2010 research paper by Christopher Soghoian and Sid Stamm "in which they present evidence that certificate authorities (CAs) may…

I think it pin's google's certificates. The article claims The goal of the attack was to "impersonate Google security certificates." I'm not saying NSA doesn't have the ability, just the implication that it was used against Brazil is likely wrong.

> I think it pin's google's certificates.

That's what I understand as well but I don't think they pin much more than that -- and certainly not every SSL certificate on every site one might connect to.

Re: New NSA Leak Shows MITM Attacks Against Major Internet Services

#54

Post by peterwwillis »

dingaling wrote: post #41
peterwwillis wrote: post #21

Some firefox add-ons to help defend against mitm: Certificate Patrol (notifies you when certs change) https://addons.mozilla.org/en-us/firefox/addon/certificate-p... Force-TLS (force websites to always use HTTPS) https://addons.mozilla.org/en-us/firefox/addon/force-tls/ Perspectives (compare certs with peers to verify authenticity) https://addons.mozilla.org/en-us/firefox/addon/perspectives/

> Some firefox add-ons to help defend against mitm: In theory yes, but not more than 10 minutes ago Cert Patrol noticed that Amazon have changed the CA for the SSL cert for an image server. What am I supposed to do? It is interesting info, but if I reject the cert then I can't be sure my connection is secure. If I accept it... I can't be sure my connection isn't MiTMed. The human factor is always the weak link.

The nature of certificates means a site can use more than one. If you use such a site, you can try to notice the pattern of which certs they use and if it changes, but it's not going to be perfect. If you choose to only use sites which use one certificate it might be a big help. Here are some more useful plugins for Firefox:

HTTPS Everywhere (preset list of sites to use only HTTPS on) https://www.eff.org/https-everywhere

Safe (shows you when a site might not or isn't using HTTPS) https://addons.mozilla.org/en-US/firefox/addon/safe/

If you want to keep your information private, don't put anything on an internet-connected device that wasn't encrypted on an airgapped computer first.

Re: New NSA Leak Shows MITM Attacks Against Major Internet Services

#55

Post by samstave »

newgre wrote: post #9

If it is true that the NSA MITMed Google connections, then one could draw the conclusion that the NSA doesn't actually have a direct connection to Google data centers (as claimed by Google). If they had such a connection, then why would they use MITM attacks against people?

It would also stand to reason that the court/LEO requests to Google for data are just a CYA/formality with respect to them "legally" getting the authorization to read the data.

They likely have the access to all the data they want. They use the legal vectors for requests just to see what the companies would give them on the request, and can compare the difference between the provided data vs the slurped data.

Re: New NSA Leak Shows MITM Attacks Against Major Internet Services

#56

Post by [deleted] »

anologwintermut wrote: post #31

I'd say this is likely bullshit at least that it was done against a Brazilian company. Why take the risk of getting caught and burning your ability to do this when you can get the information from Google? 1) Chrome(and some plugins) pin's certificates and would notice a man in the middle attack(unless it was done with google's key). Sure, most corporate targets probably use IE, but if anyone uses chrome on or one of…

[deleted]

Re: New NSA Leak Shows MITM Attacks Against Major Internet Services

#57

Post by semenko »

josteink wrote: post #20

If this is true, and that NSA has been MITMing providers like Google, they are undermining the already shabby trust the US cloud-industry has attempted to build. I doubt Google and friends are very happy about that, since that's their one big basket where all the money comes in. NSA in their eagerness to do rampant spying on everyone have had quite some collateral. They have decided to compromise the one thing which…

The HSTS commits /maybe/ suggest that Google thinks a Verisign intermediate was signing MITMs for Google properties. They just blacklisted "VeriSignClass3SSPIntermediateCA"

See: https://chromiumcodereview.appspot.com/23523051

Note that the associated bug is private (https://code.google.com/p/chromium/issues/detail?id=173460).

There's a good explanation of the "bad_static_spki_hashes" parameter here: http://ritter.vg/blog-cas_and_pinning.html

Re: New NSA Leak Shows MITM Attacks Against Major Internet Services

#58

Post by andrewcooke »

semenko wrote: post #57
josteink wrote: post #20

If this is true, and that NSA has been MITMing providers like Google, they are undermining the already shabby trust the US cloud-industry has attempted to build. I doubt Google and friends are very happy about that, since that's their one big basket where all the money comes in. NSA in their eagerness to do rampant spying on everyone have had quite some collateral. They have decided to compromise the one thing which…

The HSTS commits /maybe/ suggest that Google thinks a Verisign intermediate was signing MITMs for Google properties. They just blacklisted "VeriSignClass3SSPIntermediateCA" See: https://chromiumcodereview.appspot.com/23523051 Note that the associated bug is private ( https://code.google.com/p/chromium/issues/detail?id=173460 ). There's a good explanation of the "bad_static_spki_hashes" parameter here: http://ritter.v…

if that's the case, how did they get the private key from verisign? was it stolen? did verisign simply give them it? or was it obtained under some kind of legal process? if it was under a legal process, doesn't this raise additional questions about the judicial overview - did they realise how broad this was?

Re: New NSA Leak Shows MITM Attacks Against Major Internet Services

#60

Post by richardjs »

danbruc wrote: post #59

This might also be an indication that their advances in attacking commonly used ciphers are not that major - it does not make that much sense to perform a relatively complex MITM attack if you are able to just break the used cipher.

I wondered the same thing regarding them requesting private keys a while ago. If they could break the ciphers, why would they need the keys?
Post reply on HN