

Summary:Most people believe that SSL is the gold-standard of Internet security. It is good, but SSL communications can be intercepted and broken. Here's how.

Is the National Security Agency (NSA) really "wiretapping" the Internet ? Accused accomplices Microsoft and Google deny that they have any part in it and the core evidence isn't holding up that well under closer examination .


Ah, actually the NSA can.

And, you can too and it doesn't require "Mission Impossible" commandos, hackers or supercomputers. All you need is a credit-card number.



There's nothing new about these services. Packer Forensics was advertising appliances that could do this in 2010. The company is still in business and, while they're keeping a low profile, they appear to be offering the same kind of devices with the same services.


How SSL normally works (Credit: Dell SecureWorks)


Maybe. Maybe not.


With an SSL proxy acting as a man-in-the-middle, this is how your "secure" traffic can be read by others. (Credit: Dell SecureWorks)

The SSL proxy intercepts traffic between your computer and the Internet. When you surf to a "secure" site, it, and not your browser, get the real Web server certificate and handles setting up a perfectly good SSL connection between it and the Web server. The proxy then sends you a digital certificate, which looks like the Web server's certificate, and sets up a "secure" connection between your browser and the proxy.


Now if your company can do this at your business' firewall couldn't the NSA do something like this at a tier-one ISP? At a major company's Web hosting facility? I don't see why not. After all the NSA set up Room 641A at what was then AT&T's 611 Folsom St. building in the mid-2000s for surveillance.

Is the NSA reading your e-mail and looking over your shoulder when you visit I doubt it. With techniques like traffic and metadata analysis, they don't need to bother with that level of detail for the vast majority of people. Technically speaking could they do it? Yes. Easily and just by modifying commercial off-the shelf (COTS) hardware and software.

Related Stories:

Topics: Security, Government, Government : US, Networking, Privacy



zdnet_core.socialButton.googleLabel Contact Disclosure


Related Stories

The best of ZDNet, delivered

Subscription failed.