New NSA Leak Shows MITM Attacks Against Major Internet Services
1–10 of 149 posts
Re: New NSA Leak Shows MITM Attacks Against Major Internet Services
#2[deleted]
Re: New NSA Leak Shows MITM Attacks Against Major Internet Services
#3The simplified view given in the documentcloud link begs a question: just which CA certificate(s) is/are controlled by NSA?
Because in order to pull that MITM off, they either need to have the target service's CA - or they have the ability to fake any certificate. My guess is on the latter.
And that means at least one commonly accepted CA certificate is effectively compromised.
Re: New NSA Leak Shows MITM Attacks Against Major Internet Services
#4The simplified view given in the documentcloud link begs a question: just which CA certificate(s) is/are controlled by NSA? Because in order to pull that MITM off, they either need to have the target service's CA - or they have the ability to fake any certificate. My guess is on the latter. And that means at least one commonly accepted CA certificate is effectively compromised.
[deleted]
Re: New NSA Leak Shows MITM Attacks Against Major Internet Services
#5The documents mention the DigiNotar hack explicitly. What I do not understand is that the hack was detected when (afair) Iranian authorities tried to MITM Google connections, so the hack was claimed to come from an Iranian hacker. This begs the question whether this is wrong and the NSA hacked DigiNotar genuinely or they just used the breach (perhaps then only known to them) to fake certificates themselves. One may also take into account that DigiNotar was responsible for Netherlands public key infrastructure. This made DigiNotar possibly an even more valuable target.
Re: New NSA Leak Shows MITM Attacks Against Major Internet Services
#6The simplified view given in the documentcloud link begs a question: just which CA certificate(s) is/are controlled by NSA? Because in order to pull that MITM off, they either need to have the target service's CA - or they have the ability to fake any certificate. My guess is on the latter. And that means at least one commonly accepted CA certificate is effectively compromised.
Afaik it is not necessary that a root CA is compromised. Sufficient would be to compromise any intermediate CA who is not on a revocation list. How to circumvent Googles certificate pinning in Chrome, I have no good idea. They would need to compromise any certificate in the chain.
Re: New NSA Leak Shows MITM Attacks Against Major Internet Services
#7Google cache version:
http://webcache.googleusercontent.com/search?q=cache:www.sch...
Re: New NSA Leak Shows MITM Attacks Against Major Internet Services
#8And here I was thinking I was being an all paranoid nutter when I expressed privacy concerns with US hosted CDNs and analytics services ..
https://2x.io/read/would-the-nsa-infiltrate-cdns-to-circumve...
Re: New NSA Leak Shows MITM Attacks Against Major Internet Services
#9If it is true that the NSA MITMed Google connections, then one could draw the conclusion that the NSA doesn't actually have a direct connection to Google data centers (as claimed by Google).
If they had such a connection, then why would they use MITM attacks against people?
Re: New NSA Leak Shows MITM Attacks Against Major Internet Services
#10One more reason to not use any of the giant email providers like Yahoo, Google, and Hotmail.