topic Re: Research paper shows vulnerabilities with SSL interception in General Topics

Research paper shows vulnerabilities with SSL interception

Maxstr — Tue, 07 Mar 2017 16:14:53 GMT

On Feb 2017, some universities, Mozilla, Cloudflare, and Google released this paper on corporate and desktop HTTPS interception.

First they figured out how to identify when someone connects to a web server through an SSL interception appliance. Then they found that most corporate "man-in-the-middle' appliances expose security vulnuerabilities. Basically, most appliances don't mirror the client's browser TLS handshake, and instead uses its own less secure cipher suite.

So for example, your browser requests to connect to google.com with TLS 1.2 with AES, the firewall decrypts it, then re-encrypts it with a weaker TLS handshake (like TLS 1.0 with RC4, or worse). This effectively makes your browser's connection far less secure.

The paper grades a few appliances. Bluecoat got an "A", but Cisco got an "F". Sophos and Juniper got a "C". Unfortunately Palo Alto isn't graded, and I don't know what method it uses.

Here's the link to the paper (PDF hosted by one of the paper's authors, Zakir Durumeric): The Security Impact of SSL Interception (https://zakird.com/papers/https_interception.pdf). The juicy stuff is on page 5.

Also here is a link to an article summary about it, in case the PDF doesn't work: https://www.helpnetsecurity.com/2017/02/10/https-interception/

Re: Research paper shows vulnerabilities with SSL interception

Brandon_Wertz — Tue, 07 Mar 2017 16:00:17 GMT

Great highlight...I couldn't open your link though...

I did some Google sloothing and found this BlackHat article on this topic:

https://media.blackhat.com/bh-eu-12/Jarmoc/bh-eu-12-Jarmoc-SSL_TLS_Interception-Slides.pdf

Re: Research paper shows vulnerabilities with SSL interception

Maxstr — Tue, 07 Mar 2017 16:05:44 GMT

Don't know why that link doesn't work, but it's directly from one of the author's site. I added another link that has some article about it too.

Re: Research paper shows vulnerabilities with SSL interception

Brandon_Wertz — Tue, 07 Mar 2017 16:14:44 GMT

*It's possible my company was blocking an IP for the site...(I didn't really care to look through firewall logs to confirm) lol*

Re: Research paper shows vulnerabilities with SSL interception

Maxstr — Tue, 07 Mar 2017 16:16:47 GMT

oops, I clicked accept instead of quick reply...

I wish I could attach files to the post but I don't think they have feature here.

Re: Research paper shows vulnerabilities with SSL interception

pulukas — Sun, 19 Mar 2017 16:59:44 GMT

Here is the CERT report outlining the issues when settting up corporate decryption and not mentioning any specific vendors.

https://www.us-cert.gov/ncas/alerts/TA17-075A

Would be a good exercise to have a best practices document for how PA could follow these recomendations.