335
you are viewing a single comment's thread
view the rest of the comments
view the rest of the comments
this post was submitted on 08 Mar 2024
335 points (97.5% liked)
Europe
8332 readers
1 users here now
News/Interesting Stories/Beautiful Pictures from Europe 🇪🇺
(Current banner: Thunder mountain, Germany, 🇩🇪 ) Feel free to post submissions for banner pictures
Rules
(This list is obviously incomplete, but it will get expanded when necessary)
- Be nice to each other (e.g. No direct insults against each other);
- No racism, antisemitism, dehumanisation of minorities or glorification of National Socialism allowed;
- No posts linking to mis-information funded by foreign states or billionaires.
Also check out !yurop@lemm.ee
founded 1 year ago
MODERATORS
yes, one side has to automatically or manually accept a fake certificate/key to MITM end to end encryption. you know, like when your browser says "certificate error" and you click on advanced->accept anyway or something like that. if the software always accepts or he manually accepted one, the MITM guy can substitute his own encryption key/cert and decrypt and re-encrypt on the fly.
If you're looking at who is allowed to issue trusted root certificates in common browsers and operating systems, nobody needs to accept nothing to have every possible man in the middle from every major country's intelligence services already in there.
But that also depends on the issuer that WebEx used. If this really was a MITM without someone fucking up and bypassing a warning, whoever the root CA is issuing for WebEx can no longer be trusted.
More likely they dialed in via mobile rather than use “Computer Audio” and that is easily defeated using a Stingray-type device.
Yes, in that case, it most likely was using an insecure channel to directly dial into the conference. Still, the entire certificate infrastructure is mere security theater, unless you're actually going through the trouble of checking every individual certificate yourself.
That’s the open secret of the Web, all security on it is just fake. The list of root certificates is way too long to provide any security.
Think it’s likely to impact people with regular threat models?
Any obvious solutions?
Public WiFi is the main problem, anybody connected to the same WiFi could potentially intercept all of your Web traffic. You could use a VPN to avoid that one.
Certificate transparency, pinning, etc
It's always one of two possibilities: shit software or idiot users
In this case shit software. For a secure conference software there should be no possibility for the user to accept invalid certificates.
The developer always has to plan with what we call a DAU in germany (Dümmster anzunehmender User = dumbest user possible), and even that user should have no possibility to accidentally share a secure conference. So as a developer I would: Lock the user to certificates and encryption keys I deem secure and hook into the low level OS functions to grab the screen and disable them to prevent accidental sharing via software like Anydesk and the like which the user forgot to close. This would even interrupt the functions of a simple trojan on the PC.
Of course a dedicated attacker with physical or admin access to the device could always break these. But then you have another big security breach.
Why not both?