Why doesn't BlackHatWorld use https?

Advertise on BHW
jazzc said:
You can't get plaintext traffic out of SSL unless:

a) You have a 0-day crypto attack on the underlying encryption scheme (you don't)
b) You have a means of generating a trusted certificate (you don't)

That's it. What you are thinking of works by "downgrading" to HTTP. That assumes that a) the target site uses http as well as https and b) the user will not notice the padlock missing
Click to expand...

I meant using a SSL interceptor like Bluecoat ProxySG which allows you to get decrypted content. There are other security suites which does this as well, even though they mainly use it for legit purposes of analyzing traffic.
 
qrazy said:
I meant using a SSL interceptor like Bluecoat ProxySG which allows you to get decrypted content. There are other security suites which does this as well, even though they mainly use it for legit purposes of analyzing traffic.
Click to expand...

They install a root certificate in the employees computers via network group policies. I.e. they make their own certificate as trusted on the user computers. Then the proxy decrypts and resigns the traffic in order to read it. No root certificate installed, no decryption.
 
jazzc said:
They install a root certificate in the employees computers via network group policies. I.e. they make their own certificate as trusted on the user computers. Then the proxy decrypts and resigns the traffic in order to read it. No root certificate installed, no decryption.
Click to expand...

Exactly. I know that, but people still think that using SSL is absolutely secure.
 
I heard that HTTPS and BHW used to be an item, but then HTTPS started getting all this attention from Google. BHW isn't down with the Big G so it told HTTPS to choose which one she wanted. And, just like every whore, she ran off with the guy with the most money.

Now she's got millions of kids sucking off her pancake tits. And BHW is moving on to bigger and better things.
 
jazzc said:
They install a root certificate in the employees computers via network group policies. I.e. they make their own certificate as trusted on the user computers. Then the proxy decrypts and resigns the traffic in order to read it. No root certificate installed, no decryption.
Click to expand...
Well i didn't understand anything. ;)
 
Nut-Nights said:
Well i didn't understand anything. ;)
Click to expand...

:)

SSL is a trust based pyramid scheme. Your pc/browser contains a small number of certificates from organizations that they deem trusted. Those are the "root" certificates. When a site owner buys an SSL certificate, he does not get it directly from them, but from a reseller of shorts (who themselves bought the ability to create certificates from a reseller etc). So there is a chain of trust that your browser checks in order to establish a valid SSL session. That's done cryptographically. If all the chain is verified as secure, the browser knows it's ok.

What companies do is that they add an extra trusted certificate on their employees computers. That extra root certificate is created by them, so they can create a valid SSL certificate for say gmail.com and decrypt the traffic. But it is only valid on the computers that have that extra certificate installed. In the computers that don't have it, the chain cannot get verified for the handmade gmail.com certificate.
 
jazzc said:
:)

SSL is a trust based pyramid scheme. Your pc/browser contains a small number of certificates from organizations that they deem trusted. Those are the "root" certificates. When a site owner buys an SSL certificate, he does not get it directly from them, but from a reseller of shorts (who themselves bought the ability to create certificates from a reseller etc). So there is a chain of trust that your browser checks in order to establish a valid SSL session. That's done cryptographically. Is all the chain is verified as secure, the browser knows it's ok.

What companies do is that they add an extra trusted certificate on their employees computers. That extra root certificate is created by them, so they can create a valid SSL certificate for say gmail.com and decrypt the traffic. But it is only valid on the computers that have that extra certificate installed. In the computers that don't have it, the chain cannot not get verified for the handmade gmail.com certificate.
Click to expand...
Thats easy to understand.
 
HTTPS is used to make "man in the middle" attacks impossible. Anyone evesdropping between a user and the Internet would just see what appears to be random data. It is infact encrypted data, and can't be decrypted unless you have the correct key. Attempting to crack it would take so many years that it's considered impossible.

Whether or not BHW should be using SSL is subjective. I use SSL on everything, regardless, because its good practice and because I can :) But that's just me.
 
DrPorn said:
is infact encrypted data, and can't be decrypted unless you have the correct key.
Click to expand...

The important detail here is that there are hundreds of legitimate "master keys" out there that can be used to generate a valid key for a MITM scenario.
 
jazzc said:
The important detail here is that there are hundreds of legitimate "master keys" out there that can be used to generate a valid key for a MITM scenario.
Click to expand...

I don't follow. What do you mean by this?

MITM is only possible if the server key has been stolen, the client trusts an untrustworthy CA, or a fake CA hsa been injected. There's also SSLStrip that can be used in MITM attacks but that's a different story.

I'm not aware of any master keys that are available to be used to generate keys.
 
DrPorn said:
I don't follow. What do you mean by this?

MITM is only possible if the server key has been stolen, the client trusts an untrustworthy CA, or a fake CA hsa been injected. There's also SSLStrip that can be used in MITM attacks but that's a different story.

I'm not aware of any master keys that are available to be used to generate keys.
Click to expand...

A CA is a CA because it has a root certificate. Each root certificate can be used to create a totally legit certificate for any site. That done, it is trivial to MITM succesfully (replace the original valid certificate with the new also valid certificate on the fly).

What's more, a root certificate can be used to create other certificates that have exactly the same abilities. There is no way to track either how many of those super powerful certificates exist, nor track their generation, nor block them proactively, nor pretty much do anything other than trust them*.

According to EFF, there were ~650 CAs trusted (directly or indirectly) by Mozilla or Microsoft in 2010 (the estimate comes from ...scraping the web). In case you're thinking about the rigorous security measures etc. let me just point out the Google revoked Symantec's root key from Chrome (and Firefox followed too) in 2015 after discovering that Symantec had authored rogue SSL certs for hundreeds of domains including Google and Opera.

In other words: SSL as it is implemented is good enough to prevent the random neighborhood hax0r from sniffing your traffic, but that's all.

* kinda - things are starting to change with some new policies but for the purposes of this discussion assume that's exact.
 
jazzc said:
They install a root certificate in the employees computers via network group policies. I.e. they make their own certificate as trusted on the user computers. Then the proxy decrypts and resigns the traffic in order to read it. No root certificate installed, no decryption.
Click to expand...


Don't want to start a pissing contest. If SSL were secure then the various security agencies, and alphabet agencies, such as the GHCQ, the NSA, the CIA, the DIA, the CCDCOE, GCHQ, (or any of these Wikipedia agencies: https://en.wikipedia.org/wiki/List_of_intelligence_agencies ) and the like would all have SSL encryption listed as a cyber weapon and prohibited from export.
 
jazzc said:
A CA is a CA because it has a root certificate. Each root certificate can be used to create a totally legit certificate for any site. That done, it is trivial to MITM succesfully (replace the original valid certificate with the new also valid certificate on the fly).

What's more, a root certificate can be used to create other certificates that have exactly the same abilities. There is no way to track either how many of those super powerful certificates exist, nor track their generation, nor block them proactively, nor pretty much do anything other than trust them*.

According to EFF, there were ~650 CAs trusted (directly or indirectly) by Mozilla or Microsoft in 2010 (the estimate comes from ...scraping the web). In case you're thinking about the rigorous security measures etc. let me just point out the Google revoked Symantec's root key from Chrome (and Firefox followed too) in 2015 after discovering that Symantec had authored rogue SSL certs for hundreeds of domains including Google and Opera.

In other words: SSL as it is implemented is good enough to prevent the random neighborhood hax0r from sniffing your traffic, but that's all.

* kinda - things are starting to change with some new policies but for the purposes of this discussion assume that's exact.
Click to expand...

In simple words - is https a minus or a plus for BHW and does the forum need it? :D
 
Advertise on BHW
You must log in or register to reply here.
Sign up now!

Main Menu

Home Main Forum List Black Hat SEO White Hat SEO BHW Newbie Guide Blogging Black Hat Tools Social Media Downloads

Marketplace

Account Selling Content / Copywriting EBooks / Methods Hosting Misc Proxies For Sale SEO - Link building SEO - Packages Social Media Social Media - Panels Web Design More

Making Money

Affiliate Programs Hire a Freelancer IM Journeys Making Money Pay Per Click Site Flipping Want to Buy

BlackHat World

Dispute Resolution Forum Suggestions & Feedback Introductions Lounge
Back
Top