SSL Question

Hi,

I have a browser client that talks to a servlet using mutual authenication over SSL/HTTPS. This I believe secures the application against man in the middle type of attacks but am I right in assuming that this traffic could be intercepted by a local http proxy on the client machine - possibly changed and then sent onto the servlet?

If this is possible is there someway to provide message level security to the traffic?, the data is quite sensitive and the most likely form of attack is from someone attempting to masquarade as another user after login stage.

Thanks.

[596 byte] By [TK009a] at [2007-11-27 10:45:26]

«« Limitation of Iterator in java
»» JSPs with custom components will not compile

# 1

The proxy can only participate in the plaintext if it is a trusted endpoint to both the client and the server, in the same way that client and server trust each other. Otherwise all it is seeing is ciphertext and it can't do anything with that without tamper-evidence.

ejpa at 2007-7-28 20:12:56 >

top of Java-index,Security,Java Secure Socket Extension (JSSE)...

# 2

Not too sure that this is correct. I am using a http/https sniffer (Fiddler) on the client machine and I can change the IE settings to proxy all traffic to localhost and then I can send the traffic to this sniffer. I can use the sniffer to amend the request before sending to the server. The traffic is not encrypted and is clearly visible. I believe SSL offers transport layer security but does nothing to secure the message. Thats why sites that run web services and are looking to secure them not only run over SSL but also use some type of SOAP message security. I am a new-bie to web security but if I have mis-represented anything above please let me know.

TK009a at 2007-7-28 20:12:56 >

# 3

> I believe SSL offers transport layer security but does nothing to secure the message.

What would that mean if it didn't imply encryption?

The HTTP CONNECT message is passed in plaintext. The remainder of the conversation occurs in ciphertext.

ejpa at 2007-7-28 20:12:56 >

# 4

I hear what your saying but I can clearly see what is getting sent between client and server when routing the traffic via a sniffer on the client. I am using self-signed certs for both client and server. Does the encryption not take place at the external network card/interface level thus the proxy can see the traffic in cleartext before it is encrypted?

TK009a at 2007-7-28 20:12:56 >

# 5

Then your proxy is a trusted endpoint to one of the real endpoints and is talking plaintext to the other endpoint for some reason. Obviously your system is not secure. At this point you should hiire a security consultant.

> Does the encryption not take place at the external network card/interface level

The encryption takes place inside each endpoint host. Unless you have a hardware crypto accelerator it happens in software. In any case it happens way before the NIC gets to see it.

ejpa at 2007-7-28 20:12:56 >

Security

Java Secure Socket Extension (JSSE)

Java programming resources: FAQs, tutorials, compiler and browser download sites, documentation, books lists, IDEs, etc.

SSL Question

Security Hot Topic

Security

All Classified