[deleted]
Windows SSL Interception Gone Wild
51–60 of 137 posts
Re: Windows SSL Interception Gone Wild
#52I recently bought one of these and didn't even boot it into windows before ripping out the drive and tossing in a linux installation on my SSD. Never been more grateful to be technologically competent. Also, I am wiping that drive.
Re: Windows SSL Interception Gone Wild
#53Earlier quoted context omitted.
The superfish issue is why you run linux? You could've given the world a bit of a heads up on it, don't you think?
No, if you wipe the hd and reinstall it's not an issue. I run linux because I like it. Stuff like this doesn't happen with mainstream distros.
I know at least Mint does DNS and browser plugin ad injection.
Re: Windows SSL Interception Gone Wild
#54I think it's interesting that this BADWARE install was found more or less accidentally... apparently by some tech dude noticing that his bank login presented a Silverfish-issued CA cert. Shouldn't the possiblity have been forseen and addressed beforehand? Perhaps by... (1) Anti-virus / anti-malware makers. Does this software not notify the user when strange CA certs are put into a system's root certificate storage? I…
I found it by myself several weeks before all this news came out. I got my new Lenovo Y50, visited my own website with it and decided to see how my https cert looked. I got quite scared when I saw I was being MITMed but I googled it and there were already a ton of forum posts saying it's just stuff bundled with Lenovo. So I uninstalled it.
Note that uninstalling the program doesn't completely undo the damage; you also need to get rid of the trusted certificate that it uses to make all of its forged certs look legitimate to the browsers. (The private key for that cert has been widely distributed, and at this point, anyone can use it to make a cert for your bank that will look legitimate to your machine so long as the Superfish root cert remains in place.)
Complete instructions here: http://www.pcworld.com/article/2886278/how-to-remove-the-dan...
Re: Windows SSL Interception Gone Wild
#55Earlier quoted context omitted.
No, if you wipe the hd and reinstall it's not an issue. I run linux because I like it. Stuff like this doesn't happen with mainstream distros.
I know at least Mint does DNS and browser plugin ad injection.
Aww, really? This is the first I've heard of this.
Re: Windows SSL Interception Gone Wild
#56Earlier quoted context omitted.
(3) Google; Chrome has a rather sophisticated mechanism for detecting MITM attacks, in that it's distributed with pinned certs for several Google properties, and phones home with reports of errors it receives. This is how the DigiNotar leak[1] was discovered. Perhaps because it was persistent and on the TCP stack level the phonehomes never succeeded? The retry logic should be robust enough to try to deliver the fraud…
Chrome does not warn if the non-official root certificate is custom installed on the local machine. It needs to do this because of the various corporate web filters and anti virus tools that MITM connections too. Maybe this is a practice that needs to stop. Malware scanners can scan on the local machine after the browser has decrypted the communication and web filtering, I think, is nothing but a sign of mistrust aga…
> Maybe this is a practice that needs to stop. Malware scanners can scan on the local machine after the browser has decrypted the communication and web filtering, I think, is nothing but a sign of mistrust against the users.
It's really kind of a giant security vulnerability. If an attacker can compromise the machine doing the MITM on all the encrypted connections then they get every password and credit card number for every user in your company for every website.
Re: Windows SSL Interception Gone Wild
#57Earlier quoted context omitted.
Chrome does not warn if the non-official root certificate is custom installed on the local machine. It needs to do this because of the various corporate web filters and anti virus tools that MITM connections too. Maybe this is a practice that needs to stop. Malware scanners can scan on the local machine after the browser has decrypted the communication and web filtering, I think, is nothing but a sign of mistrust aga…
> Maybe this is a practice that needs to stop. Malware scanners can scan on the local machine after the browser has decrypted the communication and web filtering, I think, is nothing but a sign of mistrust against the users. It's really kind of a giant security vulnerability. If an attacker can compromise the machine doing the MITM on all the encrypted connections then they get every password and credit card number f…
Sure, but once you allow local administrator access to your machine, the "guest" can modify your data and software however it wants, so you've already lost.
Re: Windows SSL Interception Gone Wild
#58Ah, so this is why Facebook tries to load Flash on almost every page... Allows them to gather data like this. Always wondered why Flash was "needed". (another reason to put Flash behind click-to-play and/or push for HTML5 video)
Side note: click-to-play is a usability feature, not a security feature. It's still possible for Flash code to run before the user "clicks to play".
Since people are disagreeing with my comment, I'll add some extra information (apparently I missed the editing time window, but I stand by my original comment). I should note though that I was talking about Chrome (I don't know what the deal is with Firefox).
If you go through the Chrome bug tracker, you can find several instances where Chrome engineers point out that Click-to-Play is not meant to be a security feature, and that the "Block all" setting is what is actually secure. There are several bugs which demonstrate ways around Click-to-Play which are closed as "WontFix". A quick search yields the following quotes from Chrome engineers:
"Yes, this is why click-to-play is designed as a convenience and not a security feature. If you want plugins blocked in a way that cannot be click-jacked, use "Block all," which requires a protected browser interaction (context menu, page action, etc)." [0]
"The "Click to play" setting is not a security measure. If you want to securely block plugins you must use the "Block all" option, which is a bit less convenient than "Click to play," but provides a click-jack resistant, browser mediated interface." [1]
"I'm kicking this out of the security queue because it isn't a security mechanism ... The secure method of blocking plugins is to select "Block all" and right-click to run. Whereas the "Click to play" feature is for convenience and performance." [2]
"It's not a security feature..." [3]
[0]: https://code.google.com/p/chromium/issues/detail?id=176724
[1]: https://code.google.com/p/chromium/issues/detail?id=225636
[2]: https://code.google.com/p/chromium/issues/detail?id=160707
[3]: https://code.google.com/p/chromium/issues/detail?id=414232
I'm sure there are other instances where they talk about it more, these are just the first results I found.
Re: Windows SSL Interception Gone Wild
#59Earlier quoted context omitted.
I'm not sure why a normal user would ever need to add CAs to their root store. Can you clarify?
Plenty of enterprise users need to. There are other reasons too. I presume 'nugget is talking about the HTML rewriting aspect of the software. Injecting additional/unwanted tracking code == bad, user-requested re-writing of content == good.
Oddly Google's Android team took a different approach; on Android 4.0+ there is no way to install additional certificates without a periodic "Network may be monitored by unknown third party" notification being presented.
Very annoying if you wish to use your own CA or add another and it is also dangerous in that it masks any cert installation by malware.
Re: Windows SSL Interception Gone Wild
#60Earlier quoted context omitted.
Side note: click-to-play is a usability feature, not a security feature. It's still possible for Flash code to run before the user "clicks to play".
I think you might be confusing "click to play" in a Flash video/app vs. the browser-enforced "click to play", which in Chrome/Firefox prevents the plugin from running in that tab to begin with.
He is referring to the fact that in Chrome click to play has no security effect at all - pages can click jack you to activate it.
To quote a Chrome developer: "Click to play is not actually a security boundary. In particular, it has always been subject to click-jacking."