Forgot your password?
typodupeerror
Security

Ask Slashdot: Does Your Employer Perform HTTPS MITM Attacks On Employees? 572

Posted by Unknown Lamer
from the padlock-icon-says-I'm-good-right dept.
New submitter Matt.Battey writes "I was recently on-site with a client and in the execution of my duties there, I needed to access web sites like Google Maps and my company's VPN. The VPN connection was rejected (which tends to be common, even though it's an HTTPS based VPN service). However, when I went to Google Maps I received a certificate error. It turns out that the client is intercepting all HTTPS traffic on the way out the door and re-issuing an internally generated certificate for the site. My client's employees don't notice because their computers all have the internal CA pushed out via Windows Group Policy & log-on scripts.

In essence, my client performs a Man-In-The-Middle attack on all of their employees, interrupting HTTPS communications via a network coordinated reverse-proxy with false certificate generation. My assumption is that the client logs all HTTPS traffic this way, capturing banking records, passwords, and similar data on their employees.

My question: How common is it for employers to perform MITM attacks on their own employees?"
This discussion has been archived. No new comments can be posted.

Ask Slashdot: Does Your Employer Perform HTTPS MITM Attacks On Employees?

Comments Filter:
  • Yes they did. (Score:5, Interesting)

    by funwithBSD (245349) on Wednesday March 05, 2014 @01:40PM (#46410065)

    Yes, that is exactly what my company did. They got ratted out when they let the CA expire, but the argument was "Our hardware, our rules."

    The usage rules stated something along the lines of they had the right to inspect and alter packets on the company owned network, so there you go...

    • Re:Yes they did. (Score:5, Informative)

      by Jeremiah Cornelius (137) on Wednesday March 05, 2014 @02:03PM (#46410395) Homepage Journal

      This is very common

      Very.

      Your employer probably does little with this - it is usually a part of the configuration for Microsoft Forefront TMG (Formerly ISA Server). I f you have Outlook Web Access, and do any spend on MS recommended practices, then you have a TMG, and 9 out of 10 times, the "Inspection Proxy for SSL" feature.

      The intent is to scrub the stream for malware attachments and malicious XML, etc. Most are set-and-forget, with little competence to exploit or understand what they have done.

      Bigger corporations, or those aware of data sensitivity issues are another matter. Outbound traffic may be subject to this inspection, for DLP with something like Vontu Network Prevent. These controls are managed by folks who spend 25K on netsec, not 25 C's. :-) Then? Clever operators may be logging and trapping all kinds of info. Reports are very "compliance centric" 'tho. The DLP operator team usually has a fair amount of audit scrutiny. Usually...

      Any way, TLS is irrevocably broken. It is reasonable security, trivially implemented and nearly as easily defeated. You own DNS and the path? You own the world.

      I am involved in defining a new transport security mechanism for my company's products, because TLS/SSL of handwaving, and IPsec brittleness.

      • Re:Yes they did. (Score:5, Interesting)

        by joaommp (685612) on Wednesday March 05, 2014 @02:12PM (#46410519) Homepage Journal

        And how legal is this over there?

        This January, here in Portugal, things like that just became totally illegal, punishable with prison sentence.

        • Re:Yes they did. (Score:5, Insightful)

          by JohnFen (1641097) on Wednesday March 05, 2014 @02:26PM (#46410721)

          In the US, this is totally legal, although there may be disclosure requirements (I'm not sure). The "my system, my rules" argument wins. My workplace does this, and they informed me that they do this when I was hired.

          • Re:Yes they did. (Score:4, Informative)

            by Andy Dodd (701) <atd7@co[ ]ll.edu ['rne' in gap]> on Wednesday March 05, 2014 @02:35PM (#46410853) Homepage

            Yup. Here it's perfectly legal if you're informed. Any time I log into a machine at work I get a banner that my employer reserves the right to monitor anything I do with their network.

          • In the US, this is totally legal, although there may be disclosure requirements (I'm not sure). The "my system, my rules" argument wins. My workplace does this, and they informed me that they do this when I was hired.

            That's ridiculous, there must be some limits. The argument "my system, my rules" will not work if you were to whip your employees like slaves, so why should it hold for taking away other rights? Signing them away is a nice try, but you can't sign away all your rights.

        • Re:Yes they did. (Score:5, Insightful)

          by houghi (78078) on Wednesday March 05, 2014 @02:53PM (#46411097)

          Same in Belgium and I would guess the rest of Europe. In Europe the laws tend to lean more towards users and not companies. Also more towards privacy.

          Several places I worked have been VERY upfront on what they were doing. Most also worked with whitelists. The majority of people do not need any internet access anyway. Next they place several Internet PCs on several places, so people can look up their facebook during their breaks.

          This makes it safer for everybody, although when new staff arrives I tell them that the public PC is not something I would do any banking on, because I have NO idea how safe it realy is and it is THEIR fault if somebody robs their bank by using a public PC.

          Also up front explanation that company mail may not be used for personal use. As the Intenetcmputers are available (obviously seperated from the rest of the network. They even have a seperate internet connection.) there is no excuse to do that.

          What I hate is companies who focus on people looking at porn. Why is watching 4 minutes of porn worse then 4 hours of BBC news? One giggled perhaps a bit and the other did not work for half a day. To me the second is way worse.

          • Re:Yes they did. (Score:4, Interesting)

            by Teun (17872) on Wednesday March 05, 2014 @03:11PM (#46411307) Homepage
            I agree most of Europe is behind the voters = normal employees.

            But the company I work for is Anglo-Saxon and that's a whole different kettle of bad fish...

            Indeed they have a front page telling you it's their network and they reserve the right (any right) to protect it.
            The proxy servers are in the UK and US, although both governments luve to gather anything and either don't have a constitution or no privacy legislation they do serve employees in other more enlightened EU countries.

            One day they'll find out they are overstepping both common decency and laws.
            At least in The Netherlands the Works Counsel is on it and has been able to rectify some of the grossest breaches of privacy like a top banner with a public list (log) of any and all sites visited by any individual employee, at least including the management.

            In hindsight it would have been quite interesting to see who or management is interested in now there's rumour of a billion-Euro take-over :)

          • by TyFoN (12980)

            Here in Norway they go even further, and the company is not allowed to read your email if it is put in a folder clearly marked private.

            Personally I keep my private and work emails in separate systems, but it seems that a lot of people are using their work email for private stuff.

          • Re:Yes they did. (Score:4, Informative)

            by rk (6314) on Wednesday March 05, 2014 @04:06PM (#46411959) Journal

            What I hate is companies who focus on people looking at porn. Why is watching 4 minutes of porn worse then 4 hours of BBC news? One giggled perhaps a bit and the other did not work for half a day. To me the second is way worse.

            I don't know where you are, but in the US, that can be boiled down to 3 words: sexual harassment lawsuit. Way more damaging than someone just working half time.

          • Re: (Score:3, Insightful)

            by dnavid (2842431)

            Why is watching 4 minutes of porn worse then 4 hours of BBC news? One giggled perhaps a bit and the other did not work for half a day. To me the second is way worse.

            Straw man. Most organizations don't have a usage policy that says four wasted hours of streaming video is ok. However, many have instituted filters for porn specifically because:

            1. Generic porn sites tend to also have a far higher frequency of adware and malware content than normal.
            2. People have been sued for promoting a hostile workplace environment due to porn, but no one to my knowledge has been sued for promoting an overly British workplace.
            3. Many companies are uncomfortable with overtly adult

        • If it's illegal to police your own network and stop unauthorizes use or activity then how do companies protect themselves from liability there?

          Most American enterprises monitor their networks nothing gets in or goes out without going through something and a proxy is a very popular solution. They also usually include a disclaimer when connecting to the network or logging into a machine about monitoring, authorized use, and the possibility of prosecution for unauthorized use.

          {it's more likely a company will j

        • by asylumx (881307)
          It's perfectly legal here. As an employee, you are using company provided hardware and have signed an employment agreement stating you will only use it for business purposes. Chances are, your personal bank account, facebook page, or whatever else are not part of business purposes. If they are, then why should they be kept private from the company you're doing business on behalf of? If they aren't then why are you using company hardware & bandwidth to access them?

          I may not like the fact that the
          • Re:Yes they did. (Score:5, Insightful)

            by maxwell demon (590494) on Wednesday March 05, 2014 @03:45PM (#46411723) Journal

            For example, I have to pay travel expenses from my own money, and then get them reimbursed afterwards. That is, I may have a legitimate reason to access my bank account in order to e.g. pay my flight. But that doesn't give my employer the right to access my banking password (and possibly look what's going on in my bank account).

            Also, if I'm not allowed to access my bank account from the company network, the right thing is not to decrypt it, but to block it.

            • by asylumx (881307)
              You don't pay for an airline ticket from your bank's website. That's not how it works. That's not how any of this works.

              Click Here [esurance.com] for the reference if you haven't seen it.
        • It's legal because the computer isn't the employee's. The company owns the computer sending the transmission, the copper from the computer to the inspection hardware, pays for Internet access, and writes policies that computer and Internet usage is for work-related purposes only and all usage is subject to security measures including traffic inspection.

          The better question is: Why do you think using someone else's computer on someone else's network to transmit secure data over someone else's network connect

          • by dnavid (2842431)

            It's legal because the computer isn't the employee's. The company owns the computer sending the transmission, the copper from the computer to the inspection hardware, pays for Internet access, and writes policies that computer and Internet usage is for work-related purposes only and all usage is subject to security measures including traffic inspection.

            Careful: the first part of that statement is false in the US its only the last part that I've highlighted that makes it legal. The US has wiretapping laws that prevent unauthorized tapping of communications. Nothing in the law refers to ownership: otherwise the phone company could listen to anyone's phone calls whenever they wanted to because they own all the gear. Even in the workplace, when you use the company computer and the company network, there are still protections in place for private communicat

      • by Lumpy (12016)

        This is where a USB LTE stick works wonders....

      • Re: (Score:3, Interesting)

        by Charliemopps (1157495)

        Exactly... if you owned a network worth hundreds of millions of dollars would you let ANYTHING traverse it without your knowledge? If you did, and you got compromised, Slashdot would be all over you for being too lax in your security.

        The way it works where I'm at, it's totally transparent. You have to sign something that you're ok with being monitored when you're hired, but other than that they don't really explain anything. Then the proxy gets "hits" based on your activity. Everyone gets a bad email or cli

    • by AK Marc (707885)
      Yup, most large corporations do this, I've worked for more that did this than didn't.
    • Re:Yes they did. (Score:5, Informative)

      by hsmith (818216) on Wednesday March 05, 2014 @02:20PM (#46410649)
      Using company hardware and resources to do anything is stupid in 2014.

      Want to read your personal email, chat, facebook? Use a phone or tablet.
    • SSL Interception (Score:5, Interesting)

      by KingSkippus (799657) on Wednesday March 05, 2014 @02:24PM (#46410687) Homepage Journal

      Yes, it's actually extremely common. Google "SSL Interception", as that's the name of the feature that is advertised on hardware/software that performs this function.

      This is why I never browse private web sites on work hardware. You simply do not know how they've mangled the machine, what all it is revealing or to whom. (That's right, most large companies actually outsource security, so all of your private account numbers and passwords are going to third parties that you don't know and never will, third parties who have been indemnified and are completely immune to any kind of action or recourse from you if they screw up.) If I want to browse the web, I use a VPN connection to my house and my own personal laptop. I don't use my work smartphone for Facebook or personal email, I have my own personal phone using my own provider. When I'm working from home and VPNed into the office, I don't use my personal workstation for any work stuff, except as a VirtualBox host for a work VM, which my company has altered through group policy and direct installation of software to be configured how they want.

      It's a shame that in today's work environment we have to worry about such things, but if you think the NSA is bad about spying on you, it's small potatoes compared to what your own company does. Never trust your company to just be innocently looking for malware or other intrusion detection means. Never install any software or services on your personal equipment from your company, no matter how much more convenient it will make your life. (This includes, for example, accepting elevated permissions to connect to your work email on your personal phone.) Always assume that they're watching you, looking for anything that can be used to fire you, cancel your severance, or extort whatever they want from you, whether you're just a paean on the low rung of the corporate ladder or the CEO.

      I've worked very closely with both the network and security people in a large multinational corporation, and I've seen firsthand the kinds of things they do. It ain't pretty. I've seen people leave because they have moral qualms with the kind of monitoring that goes on, and people screwed because something innocent that everyone does was turned into a major issue. I cannot emphasize this enough; never, ever, ever mix your personal life with your work life, especially when it comes to communications and technology.

    • Re:Yes they did. (Score:5, Interesting)

      by DoofusOfDeath (636671) on Wednesday March 05, 2014 @02:24PM (#46410693)

      How does that work with website owner's terms of use, however?

      Suppose I create a website, and say that I'm only authorizing the content on my site to be accessed by username Joe.

      Joe logs into my website from his employer's computer, and his employer logs the content I send him. His employer now has unauthorized, decrypted copies of my data.

      Is the employer now in violation of the laws against unauthorized computer access, and in violation of the DMCA for circumventing my copyright mechanism? Recall that Joe has no authority to loosen my copyright claims.

    • Re:Yes they did. (Score:5, Interesting)

      by Anonymous Coward on Wednesday March 05, 2014 @02:31PM (#46410771)

      My previous company did it to:
      They installed a Blue Coat proxy, and pushed to all windows computers (what normal staff was using) the configuration to use that proxy, and installed a trusted CA certificate so the proxy would be trusted.
      That meant that most people didnt realize about the change, as both Explorer and Chrome used the Windows centralized certificate storage from day one.
      The thing only broke for Firefox users (very few) who started getting not trusted certificate errors, and the linux machines when they set the firewall to prevent any http or htts traffic not thru the proxy. Most of those people simply started clicking on the "trust certificate" button.
      A couple of weeks later they pushed an internal firefox installation and "forbid" people from installing it from the mozilla page.

      Funny notes here:
      a) they did it in an illegal way: in this country a company is allowed to monitor their employees network activity only if they make it very clear to them before starting to do so. They certainly did not. Actually our contracts said specifically that they did not.

      b) after trying all kind of things they needed to give up on the idea of preventing any http(s) traffic off the proxy, as many tools (including EDA tools) required https connections to update and so forth and would not trust the proxy certificates. So eventually the firewall was left open for https. Who knew how to, could just work around the proxy in his own computer. All linux workstations were left connecting straight.

      c) People realized and asked what was it. They lied to them with a straight face, with claims like: we dont unencrypt the proxy connections to banks, health (here we have a portal for online consultations with the public doctor and can access our medical history) or other similar private pages. This was a blatant lie anybody could check by just looking at the certificate issuing authority. They were doing it with _all_ pages.

      d) they claimed this was only so they could scan for viruses in downloads. Not to monitor any activity.

      e) I asked our local HR manager, she didnt have any problem telling the truth: "you are an engineer, you work on IT, you know how easy we can monitor anything we want.." and then made some funny remarks about the kind of pages people was enjoying in her previous company and how detailed usage reports she was getting. At that time I checked the blue coat page for the proxy we got installed, it could certainly log any activity in great detail.

      f) My concern wasnt so much that they would monitor our activity (which was creepy), but the fact that all connections were unecrypted at the proxy. So somebody with bad intentions and access to the proxy could start collecting a lot of information. And this made the proxy a great target for hacking.

  • I'm not sure why they would need to do that as a routine task. It's fairly broad and consumes resources. It'd be pretty funny if you mentioned it to their IT Director and he replied with "huh?"
    • Re: (Score:2, Interesting)

      by houstonbofh (602064)

      I'm not sure why they would need to do that as a routine task. It's fairly broad and consumes resources. It'd be pretty funny if you mentioned it to their IT Director and he replied with "huh?"

      Actually, a well configured proxy saves resources. Caching of images can save a lot, and filtering of advertising saves a huge amount of bandwidth. Then there is the filtering of content that could expose the company to lawsuits (Like porn in a harassment suit) and legal issues, and of course, job searches on company time.

      And calling it an attack is a joke. There is no middle, as the company owns everything on the network. If you have private stuff to do, use your tablet.

      • by JohnFen (1641097) on Wednesday March 05, 2014 @02:34PM (#46410833)

        The company does not own the employee, and does not own the server that the employee is talking to, and so it really is a MITM attack. The company is the middle.

        Your advice is on the nose, though. It is impossible to trust any employer run system, and therefore you should never, ever do anything of a personal nature on company systems. Even if, as where I work, using the company systems for reasonable personal use is allowed.

  • Second question: how evil is this practice?
    • It's perfectly legitimate practice on a company network to intercept encrypted traffic. Security devices used for things like intrusion protection and data leakage prevention can't work properly if all you need to circumvent them is an encrypted connection, and you really want that kind of security these days if you're using a large company network, whether you're the company management, the company employees, or the company's customers/clients.

      Doing it without making anyone using the network fully aware of

      • Re:Yes and no (Score:4, Insightful)

        by mlts (1038732) on Wednesday March 05, 2014 @02:00PM (#46410345)

        Sometimes watching encrypted traffic may be needed for some regulatory compliance. Of course, the best thing would be to have a terminal server set up to allow people to use their Web browser free and clear, while direct connections to the Internet would be monitored/logged. This way, personal E-mail and banking info isn't touched, while sensitive internal data is well protected.

    • by blueg3 (192743)

      Extremely.

      For now, set aside the question of whether it's acceptable to monitor your employees' encrypted traffic on your network.

      Technologically, it's a terrible idea. The client software and the end user no longer have any ability to inspect the actual certificates used for an HTTPS connection. From the client's perspective, all HTTPS connections are really with the MITM device and use the same cert chain. (Well, a dynamically-generated cert for the appropriate site signed by the same trusted CA using, pr

    • by AK Marc (707885)
      Most places that do it are doing it solely for the cache savings. They don't "inspect" the traffic, though they could.
  • No (Score:5, Interesting)

    by dskoll (99328) on Wednesday March 05, 2014 @01:41PM (#46410087)

    I own my company, and no... I don't do this to my employees.

    I have warned people who've abused the system (I had some casual employees who spent inordinate amounts of time on Facebook, and I've had to clamp down on music downloads that could have gotten me into trouble) but I generally use HR methods rather than technological methods to take action.

    • It doesn't have to be a question of abuse, it's more a question of security. If your firewall/intrusion detection systems don't decrypt SSL, they can't scan it for viruses/malware/intrusions/etc.

      • by dskoll (99328)

        That's true. All our desktops run Linux so we are at somewhat lower risk for most malware than Windows shops. I understand that it's still not completely foolproof, but so far we haven't had a problem.

    • DING DING DING!!! (Score:5, Insightful)

      by KingSkippus (799657) on Wednesday March 05, 2014 @03:12PM (#46411347) Homepage Journal

      You, sir (or ma'am), are doing it right. This is precisely the thing that gets me so mad at companies today, that they view these issues as an IT problem, not an HR problem. So they spend hundreds of thousands of dollars (sometimes millions) in hardware, software, salaries, support contracts, and lost time when shit breaks, just so that management 1) won't have to do their jobs--you know, managing people, and 2) will have plausible deniability when someone does do something stupid. ("It's not my fault for not making sure my workers were working on what they were supposed to and not violating company policy; IT should have blocked that site!!!")

      It's refreshing to see someone who actually gets where company policies should actually be enforced and where responsibility really ought to lie when there are gaps. Thank you!

  • Not MITM (Score:4, Insightful)

    by SparkleMotion88 (1013083) on Wednesday March 05, 2014 @01:42PM (#46410093)
    This is not a MITM attack -- it is a trusted proxy. The employees all trust the proxy, so everything works as it should. You don't trust the proxy, so you get a certificate validation error, so everything works as it should.
    • Re:Not MITM (Score:5, Insightful)

      by trigeek (662294) on Wednesday March 05, 2014 @01:46PM (#46410139)
      This is a Man-in-the-Middle if the end-user is not notified of it.
      • Re: (Score:3, Funny)

        by Anonymous Coward

        Oh the end-user was undoubtedly notified of it, probably somewhere at the bottom of their contract, in tiny writing, after the section about the lavatory and in a sentence beginning with "Beware of the leopard".

      • This is a Man-in-the-Middle if the end-user is not notified of it.

        But he was notified. He got the broken cert. And employees probably got notice in that packet they did not read.

        • He got a broken cert because he used his own computer. If you used a computer of that corporation it would have the cert bundled and you would never know that your SSL connection was being snooped.

          In the limit they could even intercept when you are downloading a browser and inject their own malware version of it. Although this seems like too much trouble.

      • by JohnFen (1641097)

        Technically, it's a MITM attack even if the user is notified of it.

    • trusted proxy

      Trusted by whom? I certainly don't trust a MiTM proxy, even when it has the word "trusted" in its name.

      • trusted proxy

        Trusted by whom? I certainly don't trust a MiTM proxy, even when it has the word "trusted" in its name.

        Trusted by the people who own the computer.

    • Re:Not MITM (Score:4, Insightful)

      by cream wobbly (1102689) on Wednesday March 05, 2014 @01:47PM (#46410159)

      Correct. It may resemble a MITM attack, but it's a proxy for pete's sake! To those like the OP who don't quite get this, refer to the agreement you signed for acceptable use of company resources before they allowed you on site.

      • Re:Not MITM (Score:5, Informative)

        by ChromaticDragon (1034458) on Wednesday March 05, 2014 @02:15PM (#46410575)

        Yup. But proxies cannot handle HTTPS unless... they are acting as a MITM.

        The proxy must either pass it along, block it outright or essentially stand in the middle so as to be able to perform all the usual filtering/sniffing/etc. it would do were the traffic plain ole' HTTP.

    • Well that's all semantics isn't it? The reality is that in many countries regulations prevent snooping of traffic to websites related to health or banking, so your company can write whatever policy it likes, it is still explicitly illegal activity.
      • in many countries regulations prevent snooping of traffic to websites related to health or banking

        Watch for language in your employment agreement to the effect: "Employees outside the group health insurance and financial departments MUST NOT access health or banking sites through the company network."

    • Re:Not MITM (Score:5, Informative)

      by Adrian Lopez (2615) on Wednesday March 05, 2014 @02:03PM (#46410387) Homepage

      A trusted proxy is a "Man in the Middle", so I presume your objection is to the word "attack"? Whatever you choose to call it, the fact is that SSL certificates are transparently being rewritten in order to capture data each website's SSL certificate was meant to stop from being captured. "Trusted proxy" is just a friendly euphemism which attempts to justify what may or may not be a legitimate practice, depending on what's being collected and whether or not the users are, in fact, specifically aware of it.

      • I object to the phrase word "Man in the Middle Attack" because that phrase has a very specific meaning. This is not a MITM attack -- at least not a successful one. The submission suggests that the corporation is exploiting some security vulnerability, when really it is just using trust in a completely appropriate* way.

        *Note that all of my comments are about computer security, not acceptable corporate behavior. Whether this is a case of corporate douchebaggery is a separate issue. I didn't comment o
    • Re:Not MITM (Score:5, Informative)

      by Rene S. Hollan (1943) on Wednesday March 05, 2014 @02:12PM (#46410535)

      At a former employer, we produced firewall hardware where this was SPECIFICALLY available as a feature. In fact, I developed the software for it. The certificates provided by the external servers are resigned by a CA cert installed on the appliance which is accepted by client machines behind it. Our equipment allowed the option of generating an internal CA cert, which would then be exported to all clients; generate a Certificate Signing Request, which could be signed by a CA already trusted by clients and imported back to the appliance (if the organization had it's own PKI infrastructure); or allow a resigning certificate and key to be imported.

      The justification is simply this: "Our network, our traffic."

      The practical reasons for this are to permit the firewall to do virus scanning on encrypted web pages and email (I handled SMTP STARTTLS and SMTP/SSL as well).

      At least as far as the work I did went, there was no official way to take the plain text traffic off the appliance - it was not "designed" to snoop on employee traffic, though if someone managed to hack the appliance this would be theoretically possible.

      Of course, if you are a contractor or employee concerned about the confidentiality of your traffic, you should exercise due diligence with regard to the CA's your machine trusts.

      In our case, we DID have the capability to specify domain names for which this resigning would not be done: those that were "trusted" by the organization installing the firewall. This made it possible to go the extra mile and make some banking site traffic secure end-to-end, but it was on a site by site basis.

      As I recall, I left the employ of this company prior to SNI support ever being implemented (we barely supported TLS 1.1, and certainly not TLS 1.2 when I was there, much to my protestations, and SNI is a TLS 1.2 Client Hello extension).

      The appliance could also be used in a reverse-fashion: protecting web servers (but not virtual ones, for lack of SNI support, unless they shared a domain name), where it could just do SSL termination, with the site-specific certificate (presumably signed by a CA trusted by most browsers), though we allowed resigning here as well, in the event the internal traffic had to remain encrypted.

       

  • I suspect... (Score:4, Informative)

    by msauve (701917) on Wednesday March 05, 2014 @01:44PM (#46410113)
    that your assumption is incorrect. Some firewalls do deep inspection, looking for malware coming from websites, via email, etc. They'll do SSL MITM to allow that to work. It doesn't necessarily mean they're doing anything nefarious.
    • by ruir (2709173)
      Finaly a sane comment...If the poster doesnt like what they do, he can browse the email/banking at home or via his mobile. Their network, their rules.
    • It doesn't necessarily mean they're doing anything nefarious.

      I either do not expect the company to be doing anything nefarious, but on this day and age of data surveillance, I'm glad that an alarm bell rings in people's minds.

  • More likely an IPS (Score:5, Informative)

    by gweeks (91403) on Wednesday March 05, 2014 @01:48PM (#46410167) Homepage

    It's more likely they are running the traffic through and IDS/IPS rather than logging everything. It's also likely that well know banking sites are excluded and just passed through. It does use quite a lot of resources to scan the traffic after all.

    IDS/IPS https://en.wikipedia.org/wiki/... [wikipedia.org]

  • In some cases you need to know everything that is going out the door. For example if your company is the target of industrial espionage the last thing you want is your trade secrets going out through your firewall.

    I would expect a lot of companies are doing this along with other similar measures.

  • We deal with highly sensitive client data. All network traffic is inspected. The employees are well aware of it because it is explicitly mentioned during new hire orientation / on boarding.

  • Paranoia (Score:5, Insightful)

    by jbmartin6 (1232050) on Wednesday March 05, 2014 @01:56PM (#46410279)

    My assumption is that the client logs all HTTPS traffic this way, capturing banking records, passwords, and similar data on their employees

    A completely baseless assumption. I have worked with several organizations who do this "attack" to protect themselves from malicious traffic. I have not yet seen any that logged content. The legal and regulatory risks in doing this are too high to do this sort of data collection.

  • I don't know if my company does this. I wouldn't be surprised if they do; many folks have already mentioned reasons why it might be desirable (for them) that aren't malicious.

    But I want to know whether it's happening so I can decide if I want to change my behavior. How would I go about checking for such things on a Windows 7 Professional laptop?

  • by RobinH (124750)
    This is a very common way to solve the problem of "how do we do a virus scan on files coming in through https?" Many organizations run a proxy server for all web requests to be able to filter content, and to do anti-virus checks, but obviously it needs to view the unencrypted content to be able to do a scan. Otherwise any employee could be downloading malicious content straight through your firewall and bypass all the checks you have in place.
  • by Antony T Curtis (89990) on Wednesday March 05, 2014 @02:08PM (#46410465) Homepage Journal

    A previous employer, a game company whose name rhymes with lizard, uses MITM proxy ... All their machines use their custom cert so that their made-up cert shows 'green' on the location box when any user uses a secure web site.

  • by bobbied (2522392) on Wednesday March 05, 2014 @02:20PM (#46410659)

    Shesh, Really? Man in the Middle "attack" ? Give me a break.

    If you are using an employer's resources to surf the internet just figure that *everything* you do is monitored. If you don't want to be monitored, GO HOME. If you don't trust your employer, GO HOME to do anything you don't want them to see. GO HOME or use your own internet access.

    Don't try to make this into some "privacy" issue. It's not.

  • My company does this (Score:4, Informative)

    by bradgoodman (964302) on Wednesday March 05, 2014 @02:31PM (#46410767) Homepage
    They do this with most "big" web sites - but not all (or many little ones). The pre-install their own root CA, so the web browser doesn't complain - but if you bothered to click on the padlock icon - you can tell the cert is signed by our IT department, not by whoever you think you're talking to.

    So we know it's happening - it's not really "hidden" - so I'ts up to me if I want to use Facebook or GMail or whatever - knowing the connection could be snooped. If I don't like it - I can simply not use those services from work.

  • Why is this legal? (Score:4, Interesting)

    by Richard_J_N (631241) on Wednesday March 05, 2014 @02:33PM (#46410815)

    As the operator of the webserver, I certainly don't consent, even if the employee had no choice..
    Is there any way to detect this server-side?

  • by dwheeler (321049) on Wednesday March 05, 2014 @03:25PM (#46411505) Homepage Journal

    This is very common in the military and in defense contractors, and it happens elsewhere too. There is a reason for it. Many of these organizations are worried about malicious stuff going in and/or exfiltration of non-public data going out. Employer MITM makes it easy to examine every packet for these kinds of things (to counter them). In the US, at least, it's generally accepted that employer equipment is owned by the employer, and thus they expressly have the authority to examine what goes over their own network... and as a condition of employment or computer use you probably signed something agreeing to this. I'm not a fan of this approach, but it certainly happens.

    Open source software that implements crypto protocols (e.g., SSL or SSH) will (correctly!) report that there's a MITM attack. So if you want to actually *use* the software in such settings, someone has to configure the software to trust the MITM. Some admins will do this automatically. If not, you may need to do it yourself. E.G., on Firefox, install the organization's certificate.

    You configure Linux systems to work in these environments, but since the certs are often files in Windows aka DOS aka CP/M format, you need to convert the files as well as put the into somewhere useful. Here's one way to deal with it.

    On Fedora, given a bunch of .crt files, you can do this:

    dos2unix *.crt ; cat *.crt >> /etc/pki/tls/certs/ca-bundle.crt

    On Ubuntu, you can do this given a bunch of .cer files:

    dos2unix *.cer ; rename 's/.cer$/.crt/' *.cer ; ca=/usr/share/ca-certificates ; mkdir -p $ca/MYORG ; cp *.crt $ca/MYORG ; cd $ca ; ls MYORG/* >> /etc/ca-certificates.conf ; update-ca-certificates

    You could avoid appending to the file if you want to, but I'll leave that as an exercise for the reader.

  • by davesag (140186) on Wednesday March 05, 2014 @05:32PM (#46412893) Homepage

    Many of the hotels I've stayed in iver the years, both major chains and smaller boutique hotels, and in several countries, have attested to MiM my secure mail server or http a sessions. Similarly I caught the Qantas lounge in Sydney trying this a few years ago. I never use hotel internets any more or airline lounges' wifi - it's just too creepy.

"You don't go out and kick a mad dog. If you have a mad dog with rabies, you take a gun and shoot him." -- Pat Robertson, TV Evangelist, about Muammar Kadhafy

Working...