Slashdot Mirror
Google Chrome Will Soon Detect Man-in-the-Middle Attacks (bleepingcomputer.com)
An anonymous reader writes:
Google Chrome 63 will include a new security feature that will detect when third-party software is performing a Man-in-the-Middle (MitM) attack that hijacks the user's Internet connection.... Most MitM toolkits fail to correctly rewrite the user's encrypted connections, causing SSL errors that Chrome will detect. The new Chrome 63 feature is in the form of a new warning screen. This new error will appear whenever Chrome detects a large number of SSL connection errors in a short timespan, a sign that someone is trying -- and failing -- to intercept the user's web traffic. This includes both malware and legitimate applications, such as antivirus and firewall applications. The new Chrome error won't show up for all antivirus and firewall software, but only for those that do not rewrite SSL connections in a proper way, resulting in SSL errors.
Chrome 63 is set for release on December 5, but users can already test it by enabling it in the Google Chrome dev branch.
Chrome 63 is set for release on December 5, but users can already test it by enabling it in the Google Chrome dev branch.
More completely indecipherable messages that to the average user translate to: "My web browser is broken".
With all the work Chrome has put into securing plugins and HTTPS, it's soon going to be completely unusable for any legitimate commercial use of the web.
Wonder how many AV products this will break?
I'm not an expert in these things, but I suspect this is another nail in the coffin for homebrew routers. I tried making one, but I found the ostensible benefits either didn't work due to https or were already featured in my four year old Asus router.
This is one Chrome feature I wish Firefox (and browsers that use the same codebase) WOULD copy.
Google is basically a trojan horse that has all your data and browsing habits and gives them away to the NSA, so why shouldn't they protect about MitM attacks. Makes sense to me.
I don't see why MITM attacks intended to capture information would cause SSL errors. I could see there being errors while breaking into an existing connection or poisoning ARP or whatever nefarious tricks are used to force the traffic through the MITM, but surely Mallory is smart enough not to mangle the messages he wants to intercept and preserve and besides, I always thought the SSL connection between the victims and the MiTM were pristine, normal SSL connections in their own right. Maybe I suppose if they wanted to modify content on the way through, but even then maybe an application layer error, not an SSL issue. Enlighten me...
Nullius in verba
Version 63 already? This things more bloated than Donald Trump's ego.
Will this further break hotel wifi?
It is irritating enough as it is, with my web browsers screaming about invalid certificates and possible MitM attacks when simply trying to pull up a Wifi login screen.
Not sure why Google would want to cut itself out from pretty much every fortune 500 company.
The legal requirements and the diligence duty require big companies to MTM all encrypted traffic.
Just tested the dev channel, and yep, the warnings make the browser pretty much unusable.
Farewell Google.
Most MitM toolkits fail to correctly rewrite the user's encrypted connections, causing SSL errors that Chrome will detect.
Shouldn't all browsers already detect incorrect encrypted connections and/or SSL errors? Otherwise, what's the point?
It must have been something you assimilated. . . .
If people really gave a shit about it, they already could. It is already very possible, with every browser out there, to identify broken certificate chains and bogus certificates. Every single browser out there first displays a "this connection is not secure" warning. Chrome adds a red URL bar with a big, red "NOT SECURE!" next to it.
You know what really bugged me to no end? That the only thing HSTS added to the mix was that people are now complaining about a page not letting them in because "something is broken in the browser". And they want to do that away. And if you try to explain, what you get is a "hey, what do you want, it's encrypted so it's safe, just get rid of that certifithingamajig there."
You cannot fix stupid.
We used to have a Bill of Rights. Now, with the rights gone, all we have left is the bill.
Will Chrome warn people about the attempted information interception as it tells them they should log into their Google account before browsing?
#DeleteChrome
I just think a lot a fake warnings have come about from these real warnings. Does the average person have the ability to decipher what is a real warning and what is fake?
This includes both malware and legitimate applications, such as antivirus and firewall applications
It would have been a good opportunity to warn the user about security software that intercept SSL. There is a real security hazard here, as we have no idea how good theses SSL client implementation are. Does it properly validates certificates, for instance?
I'm Asking Him To Change His Ways
And No Message Could Have Been Any Clearer
If You Wanna Make The World A Better Place
Take A Look At Yourself, And Then Make A Change
MITM attacks are impossible to detect without physical ownership and inspection of all links and devices along the path.
Is this so to speak feudal security? Being ruled by a browser vendor?
Also, how could I possibly detect a MITM attack if a government agency can make use of somebody else's digital certificate for tls/https, to tamper with, replace, or surveil a webpage I am visiting with tls/https?
I do hope it can be turned off I regularly use packet sniffers (Same basic idea as MIM Attack) to record user sessions which I then turn into Performance Test Scripts which is a hard enough job to start off with without having to click on an error message every time I interact with the browser.
Build a Man a Fire, and He'll Be Warm for a Day. Set a Man on Fire, and He'll Be Warm for the Rest of His Life.
The latest versions of Firefox opens a pop-bar telling you that this is probably a Wifi log-in screen and gives your the choice to open the login screen in a new tab so you can connect.
"Sufficiently advanced satire is indistinguishable from reality." - [Tips: 1DrYakQDKCQ6y52z6QbnkxHXAocMZJE61o ]
certificate patrol is an example of firefox add-on that can detect un-expected changes of certificates.
(So if suddenly a website isn't signed by "DigiCert" but by China's government you'll be alerted).
"Sufficiently advanced satire is indistinguishable from reality." - [Tips: 1DrYakQDKCQ6y52z6QbnkxHXAocMZJE61o ]
I don't see why MITM attacks intended to capture information would cause SSL errors {...} I always thought the SSL connection between the victims and the MiTM were pristine, normal SSL connections in their own right. Maybe I suppose if they wanted to modify content on the way through, but even then maybe an application layer error, not an SSL issue. Enlighten me...
ONE of the part of the SSL protocol works by having both end points agree on a common password.
The usual technique used is Diffie-Hellman or Elliptic Diffie-Hellman : it's a special cryptographic way in which two end point can agree on a common random password, and nobody else from the outside is able to guess it. (they have a way to exchange a shared secret).
(it's complicated, but it relies on special system in which you can add things together commutatively, but not separate them :
- e.g. it's easier to multiply prime number than factor the product.
- e.g.: elliptic curve maths posses an easy "addition" operation, but no trivial way to do "subtraction".
Each side picks a random number side 1 chooses A, side 2 chooses B.
Then they together publicly pick a common number C.
Side 1 computes A+C and sends it to Side 2
Side 2 computes B+C and sends it to Side 1.
External observers can't separate A from A+C nor B from B+C, they can only observe C and these (n+C) combinations.
Side 1 computes (B+C)+A
Side 2 computes (A+C)+B
- Those above are the same : it's a password that can only be known to them.
- External observers could only do (B+C)+(A+C) which is not the same number (and again they can't remove the extra additionnal C from it).)
So when two end point try to establish a secure connection only they 2 know the password, 3rd parties can't.
So if a MitM tries to intercept SSL traffic, they need to negotiate a password with the server.
But because they can only negotiate password between 2 sides, the MitM can't forward the SSL traffic to the victim user, as the user can only negotiate a *different* password. (because in the above detail, they would have guessed a different secret "B").
So the only way for a MitM to work is for the MitM to negociate a password with the server, and negociate a password with the victim,
and then decrypt-relay-rencrypt-forward the SSL traffic.
Then comes the SECOND part of SSL - certificate :
to make sure that the password you got is actually from the server you intend and not from a MitM, the exchange is also cryptographically signed with key pairs. Only the owner of the secret private key can successful sign a signature that is validated by the publicly known public key.
Thus, when establishing the SSL traffic, the server will also sign its traffic, with a key that is itself signed by a root certificate provider.
By seeing that the traffic has a legit signature, the user's browser knows that it comes from the server and not from someone pretending to be the server.
Then there are only 2 possibilities :
- most of the time : the MitM attempts fail, because they do not have access to the server's secret key, and can't forge the server's signature to pretend to be the server. They can only propose some bogus signature. The victim's browser realises that something is fishy, and it wasn't talking to the server as it though, but was talking to a MitM impersonator all along.
You get a big "Wrong certificate" message on the screen.
- a few key situation : the MitM has a way to forge a false certificate that looks legit (e.g.: they have access to a root certificate provider that will sign such a bogus certificate). This is *only the situation* where the SSL connection itself might look pristine.
BUT... there are counter measures even in that case :
- there are other source that can confirm if the correct certificate was used (some relying on DNS)
- some browser can use "certificate pinning" plugins (Certificate patrol is one such for FireFox) : if suddenly the connection isn't signed by "DigiCert" but by "China's State cert", you know something fishy is happening.
"Sufficiently advanced satire is indistinguishable from reality." - [Tips: 1DrYakQDKCQ6y52z6QbnkxHXAocMZJE61o ]
the actual purpose, is not to make things secure. As i see it, the actual purpose behind it is to make you not being able to use the web, unless you trust ALL the CA authorities that chrome+windows trust to by default.
If you have manually distrusted each and every one of those CA parasites... For every cert that Chrome cannot check the chain of trust of, it'll make a booboo, and ask you to submit it to GOOG... And if you dont trust any CA's (as you should, unless you're an idiot) this thing will stop you after a few pages?
Could Chrome also check CAA and TLSA records in a site's DNS to assure the cert being provided is the one the site owner wants to provide?
How often are users actually targeted for MITM attacks? How many have shoddy security applications that handle SSL inspection poorly?
It's hard to judge the merit without knowing, and I'm betting the balance tips toward the latter. There are a lot of garbage applications out there, even at the enterprise level.
Because INFOSEC is really: Building a skyscraper with a $5 knock-off multitool.
---
According to the latest ruleset, this post should be modded as Vorpal Flamebait +5.
Comment removed based on user account deletion
and they say they will use their power to block what they don't want you to see. They'll call what they don't want you to see "fake news", and they'll use a George Soros supported filtering app to make that determination. Facebook Twitter, Bill Gates and FireFox approve of that app so no need to be afraid. /sarcasm
Running with Linux for over 20 years!
Why would it? The chain of trust isn't broken by logging into your Google account.
By comparing an MITM to Google's collection it shows you're either trolling, or completely incapable of understanding differences in trust.
"Chain of trust" and "Google" aren't allowed in the same sentence, per secret ruling of the Supreme Court.
Not with this hotels' Wifi, apparently. I have the latest version of the big three browsers.
that's strange : I actually had the "there is apparently a log-in screen" pop-bar just the day before....
but not being able to disable the security measures just to click through a login screen is bad design on the web browsers' part.
On the "bad certificate" page in firefox, you can still click to get the details, then add an exception and make it temporary (just until you've logged in).
Disabling the security is another possible route instead of the pop-bar (one which was available long before the pop-bar itself).
"Sufficiently advanced satire is indistinguishable from reality." - [Tips: 1DrYakQDKCQ6y52z6QbnkxHXAocMZJE61o ]