TLS proxies: Insecure by design, say boffins Have you ever suspected filters that decrypt traffic of being insecure? Canadian boffins agree with you, and have said that TLS proxies – commonly deployed in both business and home networks for traffic inspection – open up cans of worms. “Not a single TLS proxy implementation is secure with respect to all of our tests, …
Why? Because they're corporate idiots, of course. They don't care about your personal security, only their corporate (i.e. financial) security.
Concur with El Reg: I can't wait to hear just how utterly braindead these corporate MITM solutions are. The only use for SSL/TLS inspection is protocol debugging; everything else is sacrosanct.
"The only use for SSL/TLS inspection is protocol debugging; everything else is sacrosanct."
Er no. The corporate owns the assets and the data so they have a right to assess encrypted pipes for the presence of bad stuff coming in and good stuff going out. What they don't own is the external internet service that is being accessed, so little or no visibility into what's transiting to and from that service without 1) monitoring it on the endpoint or 2) busting encryption open with MITM.
You know that personal phablet thing in your pocket/bag - try using that for teh pr0n, banking, booking appointments at the VD clinic and let the infosec guys get on with trying to keep the lights on and the data where it belongs.
However poor crypto implementations whether they're on the client, server or part of a MITM approach are inexcusable (the point of the research paper).
I actually only use the corporate network for work related things. Weird as i am, i care about protecting silly stuff like business intelligence. But with zscaler, the it guys are actively sabotaging proper protection of sensitive data. They are not keeping the lights on and all that, they are just being lazy.
There are a couple I can think of off the top of my head and I fully admit number 2 is essentially a bodge job.
1) I can see what sensitive corporate data such as, I dunno, customer database Employee X has uploaded to their HotGmahoo! webmail account and sent to Competitor Y. If I can inspect it I can block it/flag it/report on it. Likewise any other https sites that would otherwise not be visible to corporate web security platforms.
2) PC cert compliance. In a large corporate environment with mixed PC assets in various states of OS/browser version/patch level non-compliance you'll find machines that don't know about a lot of Trusted Root (or intermediary) CAs and supporting that is an utter nightmare, you can't go round several thousand PCs individually installing one or some, to be determined once they can't access a certain site, root certs. What you can do is push out ONE cert, the trusted corporate root CA cert, and stick one signed by that on the SSL/TLS proxy. All PCs now trust the proxy cert and the proxy can decide if the upstream web server cert is valid and allow/block accordingly.
"1) I can see what sensitive corporate data such as, I dunno, customer database Employee X has uploaded to their HotGmahoo! webmail account and sent to Competitor Y."
Sure, that's what Employee X would do. Copying it to a USB stick and bring it home? Nah ... no way.
Zscaler is going to be just as vulnerable in its own way. Security through obscurity has always been a dangerous gambit. The main reason none of these solutions is open source is the same reason national security estimates are kept classified: their flaws would be undeniably obvious and make it impossible for anyone to sign off on them -- resulting in the death of yet another cash cow. Systems configured to use Zscaler or other proxies like it should never be trusted for any purpose. Period.
The Register 
Biting the hand that feeds IT
Copyright. All rights reserved © 1998–2024
