Security firm in Tor Project 'mass surveillance' row responds
'We accept or reject, we do not store'
Customer Success Testimonial: Recovery is Everything
Cyberoam has responded to warnings that its security device open up traffic to inspection by third-parties.
Researchers affiliated to the anonymity-protecting Tor Project discovered that the skeleton key digital certificate on Cyberoam devices that permitted the inspection of SSL traffic was the same on every device.
"It is therefore possible to intercept traffic from any victim of a Cyberoam device with any other Cyberoam device - or, indeed, to extract the key from the device and import it into other DPI [deep packet inspection] devices, and use those for interception. Perhaps ones from more competent vendors," the researchers warn.
Runa Sandvik of the Tor Project and Ben Laurie began their investigation after a user in Jordan reported receiving a fake certificate upon visiting the torproject.org. Initially the researchers thought that cyberoam had been tricked into issuing a fake certificate for torproject.org, similar to the infamous DigiNotar and Comodo attacks, before realising something else was afoot.
In a blog post on Thursday, Cyberoam said tamper-protection measures meant it was not possible to export cryptographic keys from its devices. It argued that its https deep scan inspection technology was benign, and intended for network malware protection and not as a tool for "mass surveillance" as Tor researchers allege. Cyberoam said its technology followed industry best practices for SSL Bridging and didn't lend itself to man-in-the-middle attacks that the Tor researchers feared.
"Cyberoam’s private keys cannot be extracted even upon dissecting the box or cloning its hardware and software. This annuls any possibility of tampering with the existing certificates on appliance," the firm explained.
"Cyberoam UTM either accepts or rejects, but does not store HTTPS Deep Scan Inspection data, as processing is done in real-time. The possibility of data interception between any two Cyberoam appliances is hence nullified," it added.
Cyberoam specialises in making UTM security appliances which perform SSL inspection by generating their own certificates, via a mechanism similar to that used by other vendors. The technology is intended for use in small business or in the branches of larger businesses. Sys admins would install certificates from Cyberoam on devices on a network, allowing the traffic inspection technology to work without generating a warning.
The firm's UTM technology provides a bundle of functions including firewall, VPN (SSL VPN & IPSec), gateway anti-virus, anti-spam, Intrusion Prevention System (IPS), content filtering and load management. The SSL traffic inspection is only a small part of this bundle but it does mean the technology does lend itself to surveillance if deployed by ISPs and attached to the internet connections of consumers, as appears to have happened in the Jordanian case. The warning from the Tor Project remains relevant in this or similar cases.
Although Cyberoam devices are bundled with technology designed to perform HTTPS scanning for antivirus, this same technology might be use to peer into the contents of encrypted communications.
Victims should uninstall the Cyberoam CA certificate from their browsers and decline to complete any connection which gives a certificate warning, the Tor researchers advise consumers.
More discussion on the issue can be found in a blog post by the Tor Project here. ®
COMMENTS
It's not what it's for, it's what it does that is important. In an enterprise environment do you notify and make sure employees understand that you un-encrypt their banking sessions if they do online banking from a work PC?
Do you expect a US CA would say no to a US Govt agency when they said give us a cert for *.* or any one of the other countries agencies that have root certs embedded in most browsers?
Bottom line, the public think they're secure when they're not.
Re: Idiot at back of class, raises hand with a Q
There is one very important piece you're missing. In order for this type of appliance to work, the user's browser has to be configured up to accept the appliance as a root certificate authority.
You can't just put this box on a network and steal everyone's traffic. You have to convince them the box is trustworthy (or hack their browser) as well.
Re: Idiot at back of class, raises hand with a Q
"In order for this type of appliance to work, the user's browser has to be configured up to accept the appliance as a root certificate authority."
And that's exactly the problem with Cyberoam using the same key on every appliance. Once you trust one Cyberoam appliance (e.g. your employer's) you trust them all (including for example one run by GCHQ).
IT infrastructure monitoring strategies
What you need to know about cloud backup
Agentless Backup is Not a Myth
Top 10 SIEM implementer’s checklist
Customer Success Testimonial: Recovery is Everything
