Superfish opens another can of worms in MITM attacks

Impetus

Superfish is built on a "platform" from Komodia. The platform generates a universal man in the middle structure to get inside TLS communications from a PC. Works on Windows, Mac etc. Steve Gibson goes into detail on the issues. Even supports 40 bit DES keys (single DES). Komodia installs its own certificate authority cert on the PC's browsers / on Windows. A class action has started against Lenovo in the US. The world needs more class actions against eavesdropping agencies and producers and re-sellers of obviously insecure software.

Video:

http://www.podtrac.com/pts/redirect.mp4/twit.cachefly.net/video/sn/sn0496/sn0496_h264m_1280x720_1872.mp4

http://arstechnica.com/security/2015/02/ssl-hijacker-behind-superfish-debacle-imperils-big-number-of-users/

Khannie

There is another crowd that does this too. I remember reading about their product offering long ago because our company uses them for something else. I found it a bit terrifying that a company could MITM its employees without them knowing. I will dig it out today.

Impetus

Khannie wrote: »

There is another crowd that does this too. I remember reading about their product offering long ago because our company uses them for something else. I found it a bit terrifying that a company could MITM its employees without them knowing. I will dig it out today.

Companies are doing MITM to employees PCs all the time to get inside the TLS traffic. Do you trust your employer? Where is the MITM attack taking place? (eg in the US - outside of EU data privacy controls?) You need to check the certificate when you do things like ebanking to see it is issued to your bank or someone else (eg your company). Companies put their own trusted certificate authorities in employees' PCs - so your browser keeps silent on the matter. Even google searches are "secure" (ie TLS) - I wouldn't want an employer to be logging my search words after hacking the link between my PC and google.

Khannie

Impetus wrote: »

Companies are doing MITM to employees PCs all the time to get inside the TLS traffic

In Ireland they're required to inform if you if they're doing this, thankfully.

Impetus

Khannie wrote: »

In Ireland they're required to inform if you if they're doing this, thankfully.

I suspect that not 100% of companies actually advise employees of this. It could be standard policy on a system based in the US - in a company with a "close your eyes and drive on" mentality. Nobody is checking compliance, probably.

Khannie

I'm sure most people would sue the arse out of a company that was intercepting their HTTPS encrypted traffic and not informing them about it. Sure people send private emails in work. Just because it's the company's envelope doesn't give them the right to open it.

Blowfish

Khannie wrote: »

In Ireland they're required to inform if you if they're doing this, thankfully.

They are, but realistically it's done with very broad language along the lines of having something like 'x company reserves the right to monitor internet use while using x companies assets' in their IT Acceptable Use Policies. Most people would have no idea of the actual significance of something like that.

brianwalshcork

The reality is that if you're in a company with anything more than a eircom DSL box on the wall, your HTTPS traffic is more than likely being MITM'd but not for nefarious purposes...
Most content filters have an option to intercept https traffic and inspect it for malware.