a question for you people in IT

[Imdmn04]

Originally posted by: Platypus

Originally posted by: Imdmn04

Originally posted by: Platypus

Originally posted by: Imdmn04

Originally posted by: Platypus

Originally posted by: Imdmn04
Unless you are in very high position within the company, I fail to see how they would spend huge amount of resources to decrypt SSL.

People paranoid in security tend to forget the most important factor in all of security: there is always a way, but at what cost?

Most people are not important enough to justify that cost. The human factor is the most important aspect of security, not technicality.

Like I said before, it depends on where you work and what sort of confidential information you have access to. You'd better believe they monitor a lot more than 'high ranking' people these days.

Everybody access Gmail, Hotmail or Yahoo at work. In a typical 10k person company, I fail to see how they have the resources to read everybody's email. They would have several dozen supercomputers to decrypt all that much traffic. Then, you would actually need people to read it.

No, there is no need for a supercomputer nor any person to read the emails.. scripts can easily be written to snag certain data which is then read by a human.

Educate yourself:
http://www.bluecoat.de/downloa...epapers/BCS_SSL_wp.pdf

The device looks like this:
http://www.bluecoat.com/downlo...SG_8100_shadow_med.jpg

This is just one example of this technology in play, there are certainly other vendors out there. These devices are not expensive or hard to implement.

Furthermore, like I said it totally depends on the company you work for. Do you think for example that Mastercard would filter an employee's gmail for credit card numbers? Yes.
People that make less than 10 dollars an hour have access to countless credit card numbers at any given time during the day, these are certainly not high ranking positions in a company, these are the first level people you get when you call any CC company.

Like I said before, this is just one small example, think of what other protected company data is out there. Don't think you're safe because you're using SSL, it's not realistic anymore.

I briefly skimmed over the whitepaper, I may have missed it, but it looks like a device that governs SSL sessions rather than decrypt them?

I can't find the part where it says the contents are decrypted?

:roll::roll::roll:

Now you're just being obtuse, where did I ever say 'decrypt SSL'? If you notice the first time I even mentioned it:

Originally posted by: Platypus
They certainly can and certainly do depending on the company you work for. I work for a large financial corporation so our emails are constantly scrutinized for example.

Bottom line, don't do stuff at work you wouldn't want your boss reading... but they're not filtering every message you send from webmail services for example. It's quite simple for them to get around SSL encryption used by Gmail or other webmail providers and they can and will do it. If you're an unpopular person within the company or you do something that gets you written up you better believe they'll be monitoring your email/web traffic to collect anything they might need to get rid of you.

It's one thing to be ignorant and educate yourself, it's another to continue to be arrogant when you have nothing to contribute to a conversation.

The OP asked whether IT can read his/her web emails, the answer is no, for all practical purposes.

Getting around SSL sessions is not what the OP asked for. So don't get your panties in a bunch because I actually gave a valid answer.

 

[vi edit]

There are some pretty invasive security/snooping applications out there. One that I was researching ran as a hidden service and randomly took screenshots as you worked. It then emailed them off to an admin/manager. If they didn't like what they saw they could up the frequency of the screenshots and make a portfolio against you.

The thing was even configurable so that you could install it on laptops and it worked "off the network" and then phoned home once you synched back up. Imagine taking a company laptop on a work trip and while in the hotel you used the free wireless internet provided by the hotel to surf for porn at night. Well that software would actually snap pictures of that and send it back to your boss when you got back in on your trip.

 

[daveshel]

Yes. The only circumstances under which we would is if someone had some suspicions about somebody and we started watching their every move. With 10 server people and 3500+ employees, we would never do this unless someone's boss planted a wild hair in my boss's arse.

 

[Chryso]

If you are using a non encrypted session then anyone on your network using a promiscuous agent could theoretically read your email.

 

[RichieZ]

Yes and I've seen it happen to people at certain client sites, the IT nazi's will read IM's and email.

That is why I now have a 3G aircard and a blackjack, all my personal information no longer goes through any of my clients networks.

 

[Platypus]

Originally posted by: Imdmn04

Originally posted by: Platypus

Originally posted by: Imdmn04

Originally posted by: Platypus

Originally posted by: Imdmn04

Originally posted by: Platypus

Originally posted by: Imdmn04
Unless you are in very high position within the company, I fail to see how they would spend huge amount of resources to decrypt SSL.

People paranoid in security tend to forget the most important factor in all of security: there is always a way, but at what cost?

Most people are not important enough to justify that cost. The human factor is the most important aspect of security, not technicality.

Like I said before, it depends on where you work and what sort of confidential information you have access to. You'd better believe they monitor a lot more than 'high ranking' people these days.

Everybody access Gmail, Hotmail or Yahoo at work. In a typical 10k person company, I fail to see how they have the resources to read everybody's email. They would have several dozen supercomputers to decrypt all that much traffic. Then, you would actually need people to read it.

No, there is no need for a supercomputer nor any person to read the emails.. scripts can easily be written to snag certain data which is then read by a human.

Educate yourself:
http://www.bluecoat.de/downloa...epapers/BCS_SSL_wp.pdf

The device looks like this:
http://www.bluecoat.com/downlo...SG_8100_shadow_med.jpg

This is just one example of this technology in play, there are certainly other vendors out there. These devices are not expensive or hard to implement.

Furthermore, like I said it totally depends on the company you work for. Do you think for example that Mastercard would filter an employee's gmail for credit card numbers? Yes.
People that make less than 10 dollars an hour have access to countless credit card numbers at any given time during the day, these are certainly not high ranking positions in a company, these are the first level people you get when you call any CC company.

Like I said before, this is just one small example, think of what other protected company data is out there. Don't think you're safe because you're using SSL, it's not realistic anymore.

I briefly skimmed over the whitepaper, I may have missed it, but it looks like a device that governs SSL sessions rather than decrypt them?

I can't find the part where it says the contents are decrypted?

:roll::roll::roll:

Now you're just being obtuse, where did I ever say 'decrypt SSL'? If you notice the first time I even mentioned it:

Originally posted by: Platypus
They certainly can and certainly do depending on the company you work for. I work for a large financial corporation so our emails are constantly scrutinized for example.

Bottom line, don't do stuff at work you wouldn't want your boss reading... but they're not filtering every message you send from webmail services for example. It's quite simple for them to get around SSL encryption used by Gmail or other webmail providers and they can and will do it. If you're an unpopular person within the company or you do something that gets you written up you better believe they'll be monitoring your email/web traffic to collect anything they might need to get rid of you.

It's one thing to be ignorant and educate yourself, it's another to continue to be arrogant when you have nothing to contribute to a conversation.

The OP asked whether IT can read his/her web emails, the answer is no, for all practical purposes.

Getting around SSL sessions is not what the OP asked for. So don't get your panties in a bunch because I actually gave a valid answer.

How you can possibly say 'no' is completely ridiculous to me but go ahead and believe your SSL traffic / email is safe 'for all practical purposes' :roll:

Anyway... for those curious how something like this device works it's basically a glorified man in the middle attack. When a user makes an SSL request through a browser, it passes through a device like I mentioned above. The response from the server you are trying to create an SSL session with has a certificate which is by design made to identify the originating server as well as ensure secure communications between the client and the server. (The certificate wraps up the server's public key). This is the certificate that is stolen by the device in a man in the middle fashion. Before the device allows the certificate through to you, the end user, it unwraps the public key and repackages it in a spoofed certificate which is passed on to you as being legit. After this process, the device then creates a seperate tunnel to the server you're connecting to and now the device can read your plain text traffic on its way between the two points.

From there, the device can even route this information to another server for processing and searching for certain information or simply just stored in a database somewhere, the possibilities are endless.

But like I've said this entire time, you either have to work somewhere with sensitive information or be on someone's hitlist within the company. You'd be amazed at the cases that are built against employees by employers who want someone gone. As long as you're not doing anything completely suspicious or in violation of your company's policies such as going to websites you shouldn't be visiting, you're not going to get this sort of treatment for using webmail at work, but it is POSSIBLE and it's worth noting that it can easily be done if the need arrises which is the OP's original question, 'can IT people read this.' Irrefutabily the answer is yes.

 

[FreshPrince]

IT people who read other people's private emails have absolutely no ethics or are told to do so.

even if the company owns the machine, it's still wrong to read other people's stuff, which is why I never do unless their boss tells me otherwise. Even then, what I try to do is print it off quickly and try not to read it. It ain't my business...it's between, them, their boss, HR, and GOD

can it be done? anything can be done.

 

[kranky]

The smart thing to do is assume someone's reading every email you send/receive at work, so you don't do anything to put yourself at risk.

 

[Imdmn04]

Originally posted by: Platypus

Originally posted by: Imdmn04

Originally posted by: Platypus

Originally posted by: Imdmn04

Originally posted by: Platypus

Originally posted by: Imdmn04

Originally posted by: Platypus

Originally posted by: Imdmn04
Unless you are in very high position within the company, I fail to see how they would spend huge amount of resources to decrypt SSL.

People paranoid in security tend to forget the most important factor in all of security: there is always a way, but at what cost?

Most people are not important enough to justify that cost. The human factor is the most important aspect of security, not technicality.

Like I said before, it depends on where you work and what sort of confidential information you have access to. You'd better believe they monitor a lot more than 'high ranking' people these days.

Everybody access Gmail, Hotmail or Yahoo at work. In a typical 10k person company, I fail to see how they have the resources to read everybody's email. They would have several dozen supercomputers to decrypt all that much traffic. Then, you would actually need people to read it.

No, there is no need for a supercomputer nor any person to read the emails.. scripts can easily be written to snag certain data which is then read by a human.

Educate yourself:
http://www.bluecoat.de/downloa...epapers/BCS_SSL_wp.pdf

The device looks like this:
http://www.bluecoat.com/downlo...SG_8100_shadow_med.jpg

This is just one example of this technology in play, there are certainly other vendors out there. These devices are not expensive or hard to implement.

Furthermore, like I said it totally depends on the company you work for. Do you think for example that Mastercard would filter an employee's gmail for credit card numbers? Yes.
People that make less than 10 dollars an hour have access to countless credit card numbers at any given time during the day, these are certainly not high ranking positions in a company, these are the first level people you get when you call any CC company.

Like I said before, this is just one small example, think of what other protected company data is out there. Don't think you're safe because you're using SSL, it's not realistic anymore.

I briefly skimmed over the whitepaper, I may have missed it, but it looks like a device that governs SSL sessions rather than decrypt them?

I can't find the part where it says the contents are decrypted?

:roll::roll::roll:

Now you're just being obtuse, where did I ever say 'decrypt SSL'? If you notice the first time I even mentioned it:

Originally posted by: Platypus
They certainly can and certainly do depending on the company you work for. I work for a large financial corporation so our emails are constantly scrutinized for example.

Bottom line, don't do stuff at work you wouldn't want your boss reading... but they're not filtering every message you send from webmail services for example. It's quite simple for them to get around SSL encryption used by Gmail or other webmail providers and they can and will do it. If you're an unpopular person within the company or you do something that gets you written up you better believe they'll be monitoring your email/web traffic to collect anything they might need to get rid of you.

It's one thing to be ignorant and educate yourself, it's another to continue to be arrogant when you have nothing to contribute to a conversation.

The OP asked whether IT can read his/her web emails, the answer is no, for all practical purposes.

Getting around SSL sessions is not what the OP asked for. So don't get your panties in a bunch because I actually gave a valid answer.

How you can possibly say 'no' is completely ridiculous to me but go ahead and believe your SSL traffic / email is safe 'for all practical purposes' :roll:

Anyway... for those curious how something like this device works it's basically a glorified man in the middle attack. When a user makes an SSL request through a browser, it passes through a device like I mentioned above. The response from the server you are trying to create an SSL session with has a certificate which is by design made to identify the originating server as well as ensure secure communications between the client and the server. (The certificate wraps up the server's public key). This is the certificate that is stolen by the device in a man in the middle fashion. Before the device allows the certificate through to you, the end user, it unwraps the public key and repackages it in a spoofed certificate which is passed on to you as being legit. After this process, the device then creates a seperate tunnel to the server you're connecting to and now the device can read your plain text traffic on its way between the two points.

From there, the device can even route this information to another server for processing and searching for certain information or simply just stored in a database somewhere, the possibilities are endless.

But like I've said this entire time, you either have to work somewhere with sensitive information or be on someone's hitlist within the company. You'd be amazed at the cases that are built against employees by employers who want someone gone. As long as you're not doing anything completely suspicious or in violation of your company's policies such as going to websites you shouldn't be visiting, you're not going to get this sort of treatment for using webmail at work, but it is POSSIBLE and it's worth noting that it can easily be done if the need arrises which is the OP's original question, 'can IT people read this.' Irrefutabily the answer is yes.

Again, this falls into the category of "it can happen, but not likely".

How many companies actually implement such a device? How much resources does the company have to read the content? If there is a piece of software that scans for keywords, then no, it is not read by a human.

More likely than not, the answer is no to someone actually reading SSL content at the OP's company.

God, I swear IT security nazis always act like everything is within reach just for the fact of boasting about it. But when it comes down to practicality and likelihood, they simply ignore those factors.

To answer OP's question, technically they can read it, but much more likely than not, they won't be. Just like there is a chance that your car can be stolen every time you park it, but the likelihood is minimal.

 

[smack Down]

Originally posted by: Platypus

Originally posted by: Imdmn04

Originally posted by: Platypus

Originally posted by: Imdmn04

Originally posted by: Platypus

Originally posted by: Imdmn04

Originally posted by: Platypus

Originally posted by: Imdmn04
Unless you are in very high position within the company, I fail to see how they would spend huge amount of resources to decrypt SSL.

People paranoid in security tend to forget the most important factor in all of security: there is always a way, but at what cost?

Most people are not important enough to justify that cost. The human factor is the most important aspect of security, not technicality.

Like I said before, it depends on where you work and what sort of confidential information you have access to. You'd better believe they monitor a lot more than 'high ranking' people these days.

Everybody access Gmail, Hotmail or Yahoo at work. In a typical 10k person company, I fail to see how they have the resources to read everybody's email. They would have several dozen supercomputers to decrypt all that much traffic. Then, you would actually need people to read it.

No, there is no need for a supercomputer nor any person to read the emails.. scripts can easily be written to snag certain data which is then read by a human.

Educate yourself:
http://www.bluecoat.de/downloa...epapers/BCS_SSL_wp.pdf

The device looks like this:
http://www.bluecoat.com/downlo...SG_8100_shadow_med.jpg

This is just one example of this technology in play, there are certainly other vendors out there. These devices are not expensive or hard to implement.

Furthermore, like I said it totally depends on the company you work for. Do you think for example that Mastercard would filter an employee's gmail for credit card numbers? Yes.
People that make less than 10 dollars an hour have access to countless credit card numbers at any given time during the day, these are certainly not high ranking positions in a company, these are the first level people you get when you call any CC company.

Like I said before, this is just one small example, think of what other protected company data is out there. Don't think you're safe because you're using SSL, it's not realistic anymore.

I briefly skimmed over the whitepaper, I may have missed it, but it looks like a device that governs SSL sessions rather than decrypt them?

I can't find the part where it says the contents are decrypted?

:roll::roll::roll:

Now you're just being obtuse, where did I ever say 'decrypt SSL'? If you notice the first time I even mentioned it:

Originally posted by: Platypus
They certainly can and certainly do depending on the company you work for. I work for a large financial corporation so our emails are constantly scrutinized for example.

Bottom line, don't do stuff at work you wouldn't want your boss reading... but they're not filtering every message you send from webmail services for example. It's quite simple for them to get around SSL encryption used by Gmail or other webmail providers and they can and will do it. If you're an unpopular person within the company or you do something that gets you written up you better believe they'll be monitoring your email/web traffic to collect anything they might need to get rid of you.

It's one thing to be ignorant and educate yourself, it's another to continue to be arrogant when you have nothing to contribute to a conversation.

The OP asked whether IT can read his/her web emails, the answer is no, for all practical purposes.

Getting around SSL sessions is not what the OP asked for. So don't get your panties in a bunch because I actually gave a valid answer.

How you can possibly say 'no' is completely ridiculous to me but go ahead and believe your SSL traffic / email is safe 'for all practical purposes' :roll:

Anyway... for those curious how something like this device works it's basically a glorified man in the middle attack. When a user makes an SSL request through a browser, it passes through a device like I mentioned above. The response from the server you are trying to create an SSL session with has a certificate which is by design made to identify the originating server as well as ensure secure communications between the client and the server. (The certificate wraps up the server's public key). This is the certificate that is stolen by the device in a man in the middle fashion. Before the device allows the certificate through to you, the end user, it unwraps the public key and repackages it in a spoofed certificate which is passed on to you as being legit. After this process, the device then creates a seperate tunnel to the server you're connecting to and now the device can read your plain text traffic on its way between the two points.

From there, the device can even route this information to another server for processing and searching for certain information or simply just stored in a database somewhere, the possibilities are endless.

But like I've said this entire time, you either have to work somewhere with sensitive information or be on someone's hitlist within the company. You'd be amazed at the cases that are built against employees by employers who want someone gone. As long as you're not doing anything completely suspicious or in violation of your company's policies such as going to websites you shouldn't be visiting, you're not going to get this sort of treatment for using webmail at work, but it is POSSIBLE and it's worth noting that it can easily be done if the need arrises which is the OP's original question, 'can IT people read this.' Irrefutabily the answer is yes.

Can't a user identify the spoofed certificate, because the man in the middle will not have the certificate authorities private key?

 

[Platypus]

Originally posted by: Imdmn04

Originally posted by: Platypus

Originally posted by: Imdmn04

Originally posted by: Platypus

Originally posted by: Imdmn04

Originally posted by: Platypus

Originally posted by: Imdmn04

Originally posted by: Platypus

Originally posted by: Imdmn04
Unless you are in very high position within the company, I fail to see how they would spend huge amount of resources to decrypt SSL.

People paranoid in security tend to forget the most important factor in all of security: there is always a way, but at what cost?

Most people are not important enough to justify that cost. The human factor is the most important aspect of security, not technicality.

Like I said before, it depends on where you work and what sort of confidential information you have access to. You'd better believe they monitor a lot more than 'high ranking' people these days.

Everybody access Gmail, Hotmail or Yahoo at work. In a typical 10k person company, I fail to see how they have the resources to read everybody's email. They would have several dozen supercomputers to decrypt all that much traffic. Then, you would actually need people to read it.

No, there is no need for a supercomputer nor any person to read the emails.. scripts can easily be written to snag certain data which is then read by a human.

Educate yourself:
http://www.bluecoat.de/downloa...epapers/BCS_SSL_wp.pdf

The device looks like this:
http://www.bluecoat.com/downlo...SG_8100_shadow_med.jpg

This is just one example of this technology in play, there are certainly other vendors out there. These devices are not expensive or hard to implement.

Furthermore, like I said it totally depends on the company you work for. Do you think for example that Mastercard would filter an employee's gmail for credit card numbers? Yes.
People that make less than 10 dollars an hour have access to countless credit card numbers at any given time during the day, these are certainly not high ranking positions in a company, these are the first level people you get when you call any CC company.

Like I said before, this is just one small example, think of what other protected company data is out there. Don't think you're safe because you're using SSL, it's not realistic anymore.

I briefly skimmed over the whitepaper, I may have missed it, but it looks like a device that governs SSL sessions rather than decrypt them?

I can't find the part where it says the contents are decrypted?

:roll::roll::roll:

Now you're just being obtuse, where did I ever say 'decrypt SSL'? If you notice the first time I even mentioned it:

Originally posted by: Platypus
They certainly can and certainly do depending on the company you work for. I work for a large financial corporation so our emails are constantly scrutinized for example.

Bottom line, don't do stuff at work you wouldn't want your boss reading... but they're not filtering every message you send from webmail services for example. It's quite simple for them to get around SSL encryption used by Gmail or other webmail providers and they can and will do it. If you're an unpopular person within the company or you do something that gets you written up you better believe they'll be monitoring your email/web traffic to collect anything they might need to get rid of you.

It's one thing to be ignorant and educate yourself, it's another to continue to be arrogant when you have nothing to contribute to a conversation.

The OP asked whether IT can read his/her web emails, the answer is no, for all practical purposes.

Getting around SSL sessions is not what the OP asked for. So don't get your panties in a bunch because I actually gave a valid answer.

How you can possibly say 'no' is completely ridiculous to me but go ahead and believe your SSL traffic / email is safe 'for all practical purposes' :roll:

Anyway... for those curious how something like this device works it's basically a glorified man in the middle attack. When a user makes an SSL request through a browser, it passes through a device like I mentioned above. The response from the server you are trying to create an SSL session with has a certificate which is by design made to identify the originating server as well as ensure secure communications between the client and the server. (The certificate wraps up the server's public key). This is the certificate that is stolen by the device in a man in the middle fashion. Before the device allows the certificate through to you, the end user, it unwraps the public key and repackages it in a spoofed certificate which is passed on to you as being legit. After this process, the device then creates a seperate tunnel to the server you're connecting to and now the device can read your plain text traffic on its way between the two points.

From there, the device can even route this information to another server for processing and searching for certain information or simply just stored in a database somewhere, the possibilities are endless.

But like I've said this entire time, you either have to work somewhere with sensitive information or be on someone's hitlist within the company. You'd be amazed at the cases that are built against employees by employers who want someone gone. As long as you're not doing anything completely suspicious or in violation of your company's policies such as going to websites you shouldn't be visiting, you're not going to get this sort of treatment for using webmail at work, but it is POSSIBLE and it's worth noting that it can easily be done if the need arrises which is the OP's original question, 'can IT people read this.' Irrefutabily the answer is yes.

Again, this falls into the category of "it can happen, but not likely".

How many companies actually implement such a device? How much resources does the company have to read the content? If there is a piece of software that scans for keywords, then no, it is not read by a human.

More likely than not, the answer is no to someone actually reading SSL content at the OP's company.

God, I swear IT security nazis always act like everything is within reach just for the fact of boasting about it. But when it comes down to practicality and likelihood, they simply ignore those factors.

To answer OP's question, technically they can read it, but much more likely than not, they won't be. Just like there is a chance that your car can be stolen every time you park it, but the likelihood is minimal.

lol...

The OP asked for IT professionals to respond, so far there have been countless people to respond with real world experience, you can keep backpedaling all you want but we've answered his question 10 times over.. all you've done is grind your axe against people for giving real world answers. I even gave specific caveats but those don't support your grinding session so I guess you overlooked them? I didn't realize giving FACTUAL information was considered being a nazi?

You're not educated on the subject plain and simple, move on.

 

[Platypus]

Originally posted by: smack Down

Originally posted by: Platypus

Originally posted by: Imdmn04

Originally posted by: Platypus

Originally posted by: Imdmn04

Originally posted by: Platypus

Originally posted by: Imdmn04

Originally posted by: Platypus

Originally posted by: Imdmn04
Unless you are in very high position within the company, I fail to see how they would spend huge amount of resources to decrypt SSL.

People paranoid in security tend to forget the most important factor in all of security: there is always a way, but at what cost?

Most people are not important enough to justify that cost. The human factor is the most important aspect of security, not technicality.

Like I said before, it depends on where you work and what sort of confidential information you have access to. You'd better believe they monitor a lot more than 'high ranking' people these days.

Everybody access Gmail, Hotmail or Yahoo at work. In a typical 10k person company, I fail to see how they have the resources to read everybody's email. They would have several dozen supercomputers to decrypt all that much traffic. Then, you would actually need people to read it.

No, there is no need for a supercomputer nor any person to read the emails.. scripts can easily be written to snag certain data which is then read by a human.

Educate yourself:
http://www.bluecoat.de/downloa...epapers/BCS_SSL_wp.pdf

The device looks like this:
http://www.bluecoat.com/downlo...SG_8100_shadow_med.jpg

This is just one example of this technology in play, there are certainly other vendors out there. These devices are not expensive or hard to implement.

Furthermore, like I said it totally depends on the company you work for. Do you think for example that Mastercard would filter an employee's gmail for credit card numbers? Yes.
People that make less than 10 dollars an hour have access to countless credit card numbers at any given time during the day, these are certainly not high ranking positions in a company, these are the first level people you get when you call any CC company.

Like I said before, this is just one small example, think of what other protected company data is out there. Don't think you're safe because you're using SSL, it's not realistic anymore.

I briefly skimmed over the whitepaper, I may have missed it, but it looks like a device that governs SSL sessions rather than decrypt them?

I can't find the part where it says the contents are decrypted?

:roll::roll::roll:

Now you're just being obtuse, where did I ever say 'decrypt SSL'? If you notice the first time I even mentioned it:

Originally posted by: Platypus
They certainly can and certainly do depending on the company you work for. I work for a large financial corporation so our emails are constantly scrutinized for example.

Bottom line, don't do stuff at work you wouldn't want your boss reading... but they're not filtering every message you send from webmail services for example. It's quite simple for them to get around SSL encryption used by Gmail or other webmail providers and they can and will do it. If you're an unpopular person within the company or you do something that gets you written up you better believe they'll be monitoring your email/web traffic to collect anything they might need to get rid of you.

It's one thing to be ignorant and educate yourself, it's another to continue to be arrogant when you have nothing to contribute to a conversation.

The OP asked whether IT can read his/her web emails, the answer is no, for all practical purposes.

Getting around SSL sessions is not what the OP asked for. So don't get your panties in a bunch because I actually gave a valid answer.

How you can possibly say 'no' is completely ridiculous to me but go ahead and believe your SSL traffic / email is safe 'for all practical purposes' :roll:

Anyway... for those curious how something like this device works it's basically a glorified man in the middle attack. When a user makes an SSL request through a browser, it passes through a device like I mentioned above. The response from the server you are trying to create an SSL session with has a certificate which is by design made to identify the originating server as well as ensure secure communications between the client and the server. (The certificate wraps up the server's public key). This is the certificate that is stolen by the device in a man in the middle fashion. Before the device allows the certificate through to you, the end user, it unwraps the public key and repackages it in a spoofed certificate which is passed on to you as being legit. After this process, the device then creates a seperate tunnel to the server you're connecting to and now the device can read your plain text traffic on its way between the two points.

From there, the device can even route this information to another server for processing and searching for certain information or simply just stored in a database somewhere, the possibilities are endless.

But like I've said this entire time, you either have to work somewhere with sensitive information or be on someone's hitlist within the company. You'd be amazed at the cases that are built against employees by employers who want someone gone. As long as you're not doing anything completely suspicious or in violation of your company's policies such as going to websites you shouldn't be visiting, you're not going to get this sort of treatment for using webmail at work, but it is POSSIBLE and it's worth noting that it can easily be done if the need arrises which is the OP's original question, 'can IT people read this.' Irrefutabily the answer is yes.

Can't a user identify the spoofed certificate, because the man in the middle will not have the certificate authorities private key?

Yes, great point. However this can easily be embedded in your brower's trusted cert list by your company. Most corporations don't allow you to install your own software and force you to use a specific browser. If you have access to install your own software you can easily notice the attack and stop it.

 

[Imdmn04]

Originally posted by: Platypus

Originally posted by: Imdmn04

Originally posted by: Platypus

Originally posted by: Imdmn04

Originally posted by: Platypus

Originally posted by: Imdmn04

Originally posted by: Platypus

Originally posted by: Imdmn04

Originally posted by: Platypus

Originally posted by: Imdmn04
Unless you are in very high position within the company, I fail to see how they would spend huge amount of resources to decrypt SSL.

People paranoid in security tend to forget the most important factor in all of security: there is always a way, but at what cost?

Most people are not important enough to justify that cost. The human factor is the most important aspect of security, not technicality.

Like I said before, it depends on where you work and what sort of confidential information you have access to. You'd better believe they monitor a lot more than 'high ranking' people these days.

Everybody access Gmail, Hotmail or Yahoo at work. In a typical 10k person company, I fail to see how they have the resources to read everybody's email. They would have several dozen supercomputers to decrypt all that much traffic. Then, you would actually need people to read it.

No, there is no need for a supercomputer nor any person to read the emails.. scripts can easily be written to snag certain data which is then read by a human.

Educate yourself:
http://www.bluecoat.de/downloa...epapers/BCS_SSL_wp.pdf

The device looks like this:
http://www.bluecoat.com/downlo...SG_8100_shadow_med.jpg

This is just one example of this technology in play, there are certainly other vendors out there. These devices are not expensive or hard to implement.

Furthermore, like I said it totally depends on the company you work for. Do you think for example that Mastercard would filter an employee's gmail for credit card numbers? Yes.
People that make less than 10 dollars an hour have access to countless credit card numbers at any given time during the day, these are certainly not high ranking positions in a company, these are the first level people you get when you call any CC company.

Like I said before, this is just one small example, think of what other protected company data is out there. Don't think you're safe because you're using SSL, it's not realistic anymore.

I briefly skimmed over the whitepaper, I may have missed it, but it looks like a device that governs SSL sessions rather than decrypt them?

I can't find the part where it says the contents are decrypted?

:roll::roll::roll:

Now you're just being obtuse, where did I ever say 'decrypt SSL'? If you notice the first time I even mentioned it:

Originally posted by: Platypus
They certainly can and certainly do depending on the company you work for. I work for a large financial corporation so our emails are constantly scrutinized for example.

Bottom line, don't do stuff at work you wouldn't want your boss reading... but they're not filtering every message you send from webmail services for example. It's quite simple for them to get around SSL encryption used by Gmail or other webmail providers and they can and will do it. If you're an unpopular person within the company or you do something that gets you written up you better believe they'll be monitoring your email/web traffic to collect anything they might need to get rid of you.

It's one thing to be ignorant and educate yourself, it's another to continue to be arrogant when you have nothing to contribute to a conversation.

The OP asked whether IT can read his/her web emails, the answer is no, for all practical purposes.

Getting around SSL sessions is not what the OP asked for. So don't get your panties in a bunch because I actually gave a valid answer.

How you can possibly say 'no' is completely ridiculous to me but go ahead and believe your SSL traffic / email is safe 'for all practical purposes' :roll:

Anyway... for those curious how something like this device works it's basically a glorified man in the middle attack. When a user makes an SSL request through a browser, it passes through a device like I mentioned above. The response from the server you are trying to create an SSL session with has a certificate which is by design made to identify the originating server as well as ensure secure communications between the client and the server. (The certificate wraps up the server's public key). This is the certificate that is stolen by the device in a man in the middle fashion. Before the device allows the certificate through to you, the end user, it unwraps the public key and repackages it in a spoofed certificate which is passed on to you as being legit. After this process, the device then creates a seperate tunnel to the server you're connecting to and now the device can read your plain text traffic on its way between the two points.

From there, the device can even route this information to another server for processing and searching for certain information or simply just stored in a database somewhere, the possibilities are endless.

But like I've said this entire time, you either have to work somewhere with sensitive information or be on someone's hitlist within the company. You'd be amazed at the cases that are built against employees by employers who want someone gone. As long as you're not doing anything completely suspicious or in violation of your company's policies such as going to websites you shouldn't be visiting, you're not going to get this sort of treatment for using webmail at work, but it is POSSIBLE and it's worth noting that it can easily be done if the need arrises which is the OP's original question, 'can IT people read this.' Irrefutabily the answer is yes.

Again, this falls into the category of "it can happen, but not likely".

How many companies actually implement such a device? How much resources does the company have to read the content? If there is a piece of software that scans for keywords, then no, it is not read by a human.

More likely than not, the answer is no to someone actually reading SSL content at the OP's company.

God, I swear IT security nazis always act like everything is within reach just for the fact of boasting about it. But when it comes down to practicality and likelihood, they simply ignore those factors.

To answer OP's question, technically they can read it, but much more likely than not, they won't be. Just like there is a chance that your car can be stolen every time you park it, but the likelihood is minimal.

lol...

The OP asked for IT professionals to respond, so far there have been countless people to respond with real world experience, you can keep backpedaling all you want but we've answered his question 10 times over.. all you've done is grind your axe against people for giving real world answers. I even gave specific caveats but those don't support your grinding session so I guess you overlooked them? I didn't realize giving FACTUAL information was considered being a nazi?

You're not educated on the subject plain and simple, move on.

This is what's wrong with the IT crowd today, they always think in terms of sheer technical possibility and never outside of the box, always pigeon-hole themselves into the boundaries of a technical solution, ignoring the boundaries of the bigger picture.

Ever heard of the saying that "sometimes you can see more when you are outside of it than while in it"? Everything is technically possible, but what about the resources required to implement them? Time, labor, money? The technical feasibility is only a small part of the global-level feasibility as a whole, including various human factors.

Again, if you actually think the possibility of OP's company reading his/her email is greater than not being read, then you are a classical example of the "IT thinker syndrome".

 

[HeroOfPellinor]

Originally posted by: spidey07
Yes. I used to do it for fun when I was bored.

I have access to everything at my company. From personnel records to personal emails to browsing habits. And I haven't once abused that power for my own entertainment or advancement........they aren't worth my integrity. And, obviously, integrity amongst IT workers is at a high premium.

 

[spherrod]

Originally posted by: Descartes
As spidey said, they absolutely can. If it's a large company, they don't likely read random emails; however, companies with sensitive information (almost any company these days) might filter for specific content and forward them to a security group for analysis.

In short, I wouldn't worry about it. Just use discretion.

Yep - that's what we do.

 

[Dessert Tears]

Originally posted by: 3cho
if i access personal email at work, can the IT people read my outgoing and incoming mails?

If you're asking for the reason I think you're asking, I wouldn't do it.


The general consensus seems to be that it's technically possible for many or most situations, but is unlikely to affect any random user not implicated by other means. There is some likelihood that there is a generic word filter that automatically scans for words on a watchlist and forwards "content of interest" to a human for review. This filter would operate independently of the initial data acquisition.

Vulnerabilities/Tools:

• non-SSL email service - The data is in the clear, no different from screening a normal web page. The URL may be flagged for closer review, though they usually just blacklist the host.
• SSL certificate spoofing (covered in detail by Platypus) - Difficult to see if using the company-installed browser. Likely to cause a certificate warning in a "clean" browser.
• screen capture (vi_edit) - I've heard of this type of monitoring. It seems to be storage/human-intensive, but some sort of automatic filtering (OCR, "porn score" based on flesh colors) could be applied.
• remote control (yowolabi) - pcAnywhere, PC-Duo, VNC, Remote Desktop. Most places install one of these tools to facilitate remote administration - the IT personnel can directly address the problem while remaining on the phone with the end-user. More difficult to integrate with an automated monitoring system.
• keylogger - Very low data generation, can be fed to text filter with minor treatment to remove ^H and such.

Originally posted by: yllus
Anything coming in or out of your computer can theoretically be read. Even if it's encrypted.

Originally posted by: Imdmn04
They would have several dozen supercomputers to decrypt all that much traffic.

I'm pretty sure that the probability of decrypting a single SSL certificate using a brute-force attack with today's technology is extremely low. Gmail's certificate is AES-256 (256-bit) and valid for just over a year.

Originally posted by: Platypus
This is just one example of this technology in play, there are certainly other vendors out there. These devices are not expensive or hard to implement.

The whitepaper reads more like a sales brochure than a technical document. I skimmed it once and was struck by how it glosses over the technical details and unsavory history with pretty figures (though appropriate ones) and sales-speak. Like you mention elsewhere, this is a man-in-the-middle attack - that SSL is designed to prevent.

I guess I'm jaded. In Fall 2003, I completed a group project that implemented a DNS spoof attack over wireless. A successful attack redirects the victim to a fake site which could contact the real site and function as a MITM. At the time, we found a Linux toolkit (called Monkey Jacket, IIRC) that did the DNS spoof, the MITM with on-the-fly certificate spoofing, and other wireless "security evaluation" - made available at least a year before. I'm amused that there's now a class of enterprise-level products.

Originally posted by: Platypus

Originally posted by: smack Down
Can't a user identify the spoofed certificate, because the man in the middle will not have the certificate authorities private key?

Yes, great point. However this can easily be embedded in your brower's trusted cert list by your company. Most corporations don't allow you to install your own software and force you to use a specific browser. If you have access to install your own software you can easily notice the attack and stop it.

• The fingerprints are hashes of the certificate including the key and cannot be faked. It is nearly as difficult (depends on the number of bits in the hash output) to find a matching hash as it is to find the key itself. One could view the certificate outside work, record the hashes, and compare - matching hashes is a guarantee that the complete certificate also matches.
• Depending on the level of sophistication, the spoofed certificate may be easily identified. If one works for Company X, has a Company X trusted authority certificate, and has a Gmail certificate issued by Company X, the Gmail certificate is a clear fake. It is possible to fake all the authority certificates registered in the company-installed browser without much additional work, but the fakes can be detected by hash comparison as mentioned above.
• It's possible that there is an automated way to push the company's certificates to popular unauthorized browsers (like Firefox). As the computer is ultimately controlled by anyone with Administrator access, the assumption that a browser is "clean" is not necessarily good.

If anyone is paranoid enough to need any of this information, I would suggest avoiding accessing personal email at work in all situations. Get a data plan for your phone and/or read your email at home.

 

[spidey07]

Originally posted by: Flatscan
If anyone is paranoid enough to need any of this information, I would suggest avoiding accessing personal email at work in all situations. Get a data plan for your phone and/or read your email at home.

It's not a question of being paranoid. The question was can IT read your e-mail.

The answer is yes.

 

[Dessert Tears]

Originally posted by: spidey07
It's not a question of being paranoid. The question was can IT read your e-mail.

The answer is yes.

That is the explicit question asked by the OP. One may infer the related questions "by what methods?", "how likely?", and "should I worry?", which are all discussed in this thread. I think that a user examining certificate hash keys is paranoid.

 

[JRock]

Originally posted by: spidey07
Yes. I used to do it for fun when I was bored.

:thumbsup:

 

[funkymatt]

the company I used to work for not only moitored internal email, but also had keyloggers installed on each machine. it would generate a new log every time you logged in. Some people google search for the weirdest sh!t. there were periodic screenshots too.

good times.

 

[yowolabi]

Originally posted by: Imdmn04

This is what's wrong with the IT crowd today, they always think in terms of sheer technical possibility and never outside of the box, always pigeon-hole themselves into the boundaries of a technical solution, ignoring the boundaries of the bigger picture.

Ever heard of the saying that "sometimes you can see more when you are outside of it than while in it"? Everything is technically possible, but what about the resources required to implement them? Time, labor, money? The technical feasibility is only a small part of the global-level feasibility as a whole, including various human factors.

Again, if you actually think the possibility of OP's company reading his/her email is greater than not being read, then you are a classical example of the "IT thinker syndrome".

Actually what's wrong is you overcomplicated a simple question. Can IT read my incoming and outgoing email? The answer is indisputably "yes". Every one in IT who responded also said that it's not likely that they will, but that they definitely have the power to. Nice job arguing against the strawman of "if you actually think the possibility of OP's company reading his/her email is greater than not being read, then you are a classical example of the IT thinker syndrome". I don't see anyone here saying that IT is reading his mail, just that they can.

And with all this talk about SSL, you've failed to recognize that many companies take screenshots and use keyloggers and remote access tools, which don't have a huge cost in either time or money. They don't generally use them for everybody, but they can certainly use them on any individual they target. If someone is looking at your screen while you are, they can see both incoming and outgoing emails without caring if it's SSL protected or not.

 

[Imdmn04]

Originally posted by: yowolabi

Originally posted by: Imdmn04

This is what's wrong with the IT crowd today, they always think in terms of sheer technical possibility and never outside of the box, always pigeon-hole themselves into the boundaries of a technical solution, ignoring the boundaries of the bigger picture.

Ever heard of the saying that "sometimes you can see more when you are outside of it than while in it"? Everything is technically possible, but what about the resources required to implement them? Time, labor, money? The technical feasibility is only a small part of the global-level feasibility as a whole, including various human factors.

Again, if you actually think the possibility of OP's company reading his/her email is greater than not being read, then you are a classical example of the "IT thinker syndrome".

Actually what's wrong is you overcomplicated a simple question. Can IT read my incoming and outgoing email? The answer is indisputably "yes". Every one in IT who responded also said that it's not likely that they will, but that they definitely have the power to. Nice job arguing against the strawman of "if you actually think the possibility of OP's company reading his/her email is greater than not being read, then you are a classical example of the IT thinker syndrome". I don't see anyone here saying that IT is reading his mail, just that they can.

And with all this talk about SSL, you've failed to recognize that many companies take screenshots and use keyloggers and remote access tools, which don't have a huge cost in either time or money. They don't generally use them for everybody, but they can certainly use them on any individual they target. If someone is looking at your screen while you are, they can see both incoming and outgoing emails without caring if it's SSL protected or not.

Here is another "IT thinker", you bunch get so defensive on a technicality. You always have to exert that fact you can do anything, even if it take unrealistic amount of effort. Yes we know you are all mighty and powerful.

Screenshots is great and all. But who is gonna read those screenshots? Does that not take resources? Do you have a bunch of contractors in India reading your 10,000 empoyees' daily screenshots?

Again, the answer is unlikely. The op asked a question, I gave the most useful answer, whether it is semantically/techicanlly accurate to you IT people, I don't care.

 

[ultimatebob]

I never bother looking at customer's personal data unless they're having a problem accessing it.

Besides, most of the stuff that people store in their e-mail and on the file server is boring anyway! It's not like I work at Penthouse or something

The only time in 6 years that I've flipped out on a customer for storing inappropriate data was when a code repository server with only 15 GB of space filled up and a found a Gig of pirated MP3's in the shared folder while I was cleaning it up. That kind of stuff can get someone fired if an auditor ever caught it.

 

[spidey07]

Originally posted by: Imdmn04

Here is another "IT thinker", you bunch get so defensive on a technicality. You always have to exert that fact you can do anything, even if it take unrealistic amount of effort. Yes we know you are all mighty and powerful.

Screenshots is great and all. But who is gonna read those screenshots? Does that not take resources? Do you have a bunch of contractors in India reading your 10,000 empoyees' daily screenshots?

Again, the answer is unlikely. The op asked a question, I gave the most useful answer, whether it is semantically/techicanlly accurate to you IT people, I don't care.

you're just defensive because we read your e-mails. They were flagged for inappropriate content and are now being recorded/analyzed.

 

[Imdmn04]

Originally posted by: spidey07

Originally posted by: Imdmn04

Here is another "IT thinker", you bunch get so defensive on a technicality. You always have to exert that fact you can do anything, even if it take unrealistic amount of effort. Yes we know you are all mighty and powerful.

Screenshots is great and all. But who is gonna read those screenshots? Does that not take resources? Do you have a bunch of contractors in India reading your 10,000 empoyees' daily screenshots?

Again, the answer is unlikely. The op asked a question, I gave the most useful answer, whether it is semantically/techicanlly accurate to you IT people, I don't care.

you're just defensive because we read your e-mails. They were flagged for inappropriate content and are now being recorded/analyzed.

I have nothing to hide. My work email is all business, and I hardly ever check my web mail at work. I just don't understand why companies would spend so much time and resources on watching negligible things that employees do. There are better performance indicators. If we are all judged on who surfs the net most, everybody on ATOT at work would be fired.

This type of surveillances is usually used as supplementary evidence, most companies are not gonna do anything with the recorded data, unless they have a reason to. I guarantee 99.9 percent of the data collected are not read.