SysAdmin Journal · Cybersecurity

What is TLS encryption and how does it secure your internet communication?

Ish Sookun — Mon, 25 Jul 2022 18:45:21 +0000

The past few days, on several occasions, the former CEO of Mauritius, when addressing to journalists, he alleged that the private messages (email, Facebook, etc...) could be decrypted by someone who intercepted the internet traffic at the Baie Jacotet Submarine Cable Landing Station. This statement has been blown out of proportion and to add more fuel to the fear mongering, some IT expert who intervened in a radio programme even said that during a penetration testing exercise, data captured can be decrypted using "some software".

Is it really possible?

In order to understand whether the encrypted internet traffic can be decrypted by someone who sniffed your ISP's network, we should first understand how cryptography works with internet communications. So, let's dig.

If you're interested in the cryptography part only, then head to lesson no. 3 directly.

Lesson no. 1 — Transmission Control Protocol (TCP)

Two weeks ago I published a blog post explaining about Internet Protocol (IP) addresses and network packets. I explained how every file transmitted on the internet is first broken into pieces called packets and each packet has a header and payload.

Internet Protocol (IP) packet headers contain the source and destination addresses. When all the units of a packet reach their destination and are reconstructed into one data packet, the receiving device needs to know what application should handle this packet. This is what the Transmission Control Protocol (TCP) does.

TCP's role is to ensure reliable transmission of packets. TCP is used on top of the Internet Protocol and they are commonly referred to as the TCP/IP suite. When a packet is sent over the internet, the data portion of an IP packet is wrapped in a TCP segment.

Image source: Khan Academy

Thus, the data packet now has the additional information about source port number and destination port number. Before we understand what is the meaning of these two additional source/destination values, let's have a look at how a TCP connection is made between two devices.

Because packets can sometimes get lost in a network, TCP has to establish a reliable connection between two devices. These two devices can be a smartphone and the facebook.com server for example. TCP ensures the reliable connection by doing a three-way handshake. What does that mean?

The above image shows the TCP header with the ACK and SYN bits in red. These two bits are turned on and off to start the three-way handshake. The smartphone sends a packet to facebook.com with the SYN bit on. This basically means that the smartphone wants to synchronise with the facebook.com server. The server will respond by sending back a packet with both the SYN and ACK bits on. Upon receiving this, the smartphone will send another packet to the facebook.com server with the ACK bit on. The successful delivery of these packets concludes that each of them are able to establish a reliable communication and thus a TCP session starts between the two devices.

SYN means synchronise, ACK means acknowledge and when I say the bit is turned on, I mean the value of this bit is 1 instead of zero.

Once a TCP session is established, data packets can be sent back and forth for communication.

Lesson no.2 — Application Layer Protocols

Quick recap, the IP header contains the source IP address and the destination IP address, while the TCP header contains the source port number and the destination port number.

These port numbers refer to application layer protocols. A web server, like Apache, serves webpages using the Hypertext Transfer Protocol (HTTP) over the TCP port 80. The same web server will use the Hypertext Transfer Protocol Secure (HTTPS) protocol over the TCP port 443.

Therefore, when the smartphone establishes a TCP session with facebook.com and sends a request to visit https://facebook.com, the TCP packet will check the destination port and deliver the packet to the web server listening on TCP port 443.

However, in order for Apache to deliver a secure transmission it makes use of another protocol called the Transport Layer Security (TLS). Here comes encryption!

Lesson no. 3 — Transport Layer Security (TLS) Protocol

The Transport Layer Security (TLS) is a cryptographic protocol designed to render our internet communication secure. It does so by encrypting our internet traffic.

Encryption is the process of converting human readable plain text to completely incomprehensible text.

Symmetric cryptography, same key is used to encrypt and decrypt

The above diagram depicts a symmetric encryption process and perhaps a lot of people are thinking that encryption of messages on the internet occurs this way. Thus, someone getting the « key » could basically decrypt all encrypted messages. Encryption of internet communication is a lot more complex that this.

TLS 1.0 was defined in RFC 2446 back in 1999. Currently, the latest recommendation for TLS is to implement version 1.2 and 1.3 and to completely drop the use of the Secure Sockets Layer (SSL) protocol, the predecessor of TLS.

Despite the deprecation of SSL, it still lives in the security jargon and is found in the names of major security-related applications, e.g OpenSSL, SSL certificate providers etc.

An RFC is a document that contains technical specifications for the internet. RFC documents are produced by the Internet Engineering Task Force.

Let's talk about TLS encryption now.

Encryption of internet communication over HTTPS is achieved by applying the TLS protocol using a combination of symmetric and public-key cryptography.

In symmetric cryptography the key to encrypt and the key to decrypt is the same, whereas in public-key cryptography the encryption and decryption keys are different.

Public-key cryptography, the key to encrypt and key to decrypt are different

To better understand public-key cryptography, have a look at the above diagram. Then, imagine someone communicating on Facebook. The way the encryption works here is that Facebook has two keys – a public key and a private key. The private key is stored on the Facebook servers and it is never shared or transmitted on the Internet while communicating with Facebook.

Facebook sends its public key to a user, using which the latter can encrypt a piece of information and send back to the Facebook servers. This encrypted information cannot be decrypted using the public key again. It can only be decrypted using the private key that only Facebook holds.

If someone intercepts the internet traffic and gets a copy of the encrypted information intended for Facebook, then that person cannot read the actual information. The captured data will be useless.

Symmetric vs Public-key cryptography

Symmetric cryptography is fast. It can complete an operation within nanoseconds. Public-key cryptography is slower, taking microseconds to milliseconds per operation.

Therefore, TLS uses both to ensure that data transmission is secure, reliable, cannot be decrypted in trasit and at the same time transmission is fast.

It does so by initiating a public-key exchange to securely share a secret key. That secret key is then known only to the user and the receiver, e.g Facebook. The use of public-key cryptography for sharing session secrets (keys) ensures that the secret won't be captured and decrypted while in transit. Thus, further communication between the user and Facebook can be done using symmetric cryptography once the shared secret is exchanged using public-key cryptography.

Ciphers

The strength of encryption depends on the cipher user. A cipher is an algorithm that performs that actual encryption. A cipher itself is based on mathematical formulae. For example, the Diffie-Hellman key agreement algorithm is considered a major breakthrough in cryptography. It is widely used in public-key cryptography. Weak ciphers can be broken using fast computers. It's very common for organisations to carry out a vulnerability assessment of their IT infrastructure to find such weaknesses and apply the industry best practices.

Lesson no. 4 — SSL/TLS Certificates

So far we've seen how TLS sessions ensure secure communication. But what about trust? How can we be sure that the server presenting itself as facebook.com is actually Facebook's server and not a cybercriminal diverting the internet traffic to another server that pretends to be Facebook.

This is achieved by establishing a chain of trust through a Public Key Infrastructure (PKI).

A Public Key Infrastructure governs the issuance and management of digital certificates. These certificates follow the X.509 standard for public-key certificates defined by the International Telecommunication Union (ITU).

What you should know about this is that there are organisations called Certificate Authorities (CA) and they issue certificates to other organisations who need to certify their domain names as secure. These CAs are recognised by the operating systems (e.g Microsoft Windows, Apple macOS, Linux distributions) and browser makers. Therefore, when a certificate is presented by a web server to a browser, ascertaining a domain name, the browser looks at who issued the certificate first. If that Certificate Authority is in its trusted list then only it'll trust the website and display the secure padlock in the address bar.

Otherwise, the website or application throws an error and complains about untrusted connection.

In Google Chrome, if you click on the padlock, then click Connection is secure > Certificate is valid, a window pops up showing the details of the certificate, like when it expires and which Certificate Authority issued the certificate.

In the above screenshot, you can see that the certificate was issued by DigiCert intermediary CA for the facebook.com domain. DigiCert is also the Root CA in this chain. Google Chrome trusts the DigiCert Root CA and hence trusts the chain that follows.

DigiCert verifies the domain ownership before issuing certificates. It's not like anyone can just buy a certificate for any domain on the internet.

Therefore, if someone else generates a certificate for facebook.com and presents itself as facebook.com to Google Chrome, then the latter will prompt the user that the website cannot be trusted.

Conclusion

Finally, in this blog post, if you read the whole of it and the one I wrote about network sniffing, then by now you must know how secure internet communications occur and why it is not just something that one can break or decrypt.

Therefore, summarising it, remember that the Internet Protocol (IP) is responsible for addressing on the internet. It specifies the source and destination address of packets. These packets are able to travel the world and reach their intended destination reliably thanks to the three-way-handshake defined in the Transmission Control Protocol (TCP). To secure the communication over TCP, web servers use the Hypertext Transfer Protocol Secure (HTTPS) and Transport Layer Security (TLS) to encrypt information using a combination of symmetric and public-key cryptography. The strength of the encryption depends on the cipher that is used. Lastly, X.509 formatted certificates are used to help browsers and mobile applications trust the domains that host the websites and other content on the internet.

I created the cryptography diagrams using Figma and images from flaticon.com.

My thoughts on the Cybersecurity and Cybercrime Bill

Ish Sookun — Sun, 31 Oct 2021 13:06:51 +0000

This Cybersecurity and Cybercrime Bill was presented to the National Assembly on the 22nd October 2021. It is meant to replace the current Computer Misuse and Cybercrime Act that dates 2003.

A few people asked me about my opinion on the Bill and it is only today that I read the document and I share a few things that I found pertinent about the Bill.

At the beginning of the document, the Budapest Convention on Cybercrime is mentioned and the Bill is said to increase compliance with the same through additional criminal offences related to cybercrime and cybersecurity, improved investigation techniques and increased international cooperation.

I don't see any improved investigation technique in this document. There does not seem anything that will drastically reduce the time to solve a cybercrime.

Anything related to Mutual Assistance, obtaining data from service providers etc, was already possible under current legislation. This Bill will probably reduce the paperwork if there is a will for that but not improve the investigation technique.

What is the Budapest Convention on Cybercrime?

It is the first international treaty that aims to harmonize laws on cybercrime and cybersecurity and increase cooperation among countries. It was initiated by the Council of Europe and opened for signature in November 2001. In two decades, 66 countries have acceded to the convention. Mauritius acceded to the convention in November 2013.

The convention provides a guideline to countries for implementing a legislation against cybercrime. The full guideline is available on the website of the Council of Europe. Some of the main articles of the guideline are (I refer to their article number):

Article 1 — Definitions
Article 2 — Illegal access
Article 3 — Illegal interception
Article 4 — Data Interference
Article 5 — System Interference
Article 6 — Misuse of devices
Article 7 — Computer-related forgery
Article 8 — Computer-related fraud
Article 9 — Offences related to child pornography
Article 10 — Offences related to infringements of copyright and related rights
Article 15 — Conditions and safeguards
Article 19 — Search and seizure of stored computer data
Article 20 — Real-time collection of traffic data
Article 21 — Interception of content data
Article 25 — General principles relating to mutual assistance

The guideline highlights the importance of safeguards and the protection of human rights & liberties in Article 15.

Current Cybercrime legislation

The Computer Misuse and Cybercrime Act came into force in 2003. Although, Mauritius hadn't yet acceded to the Budapest Convention on Cybercrime, the legislation had some provisions as stated in the Convention guideline.

What's new in the Cybersecurity and Cybercrime Bill?

New terms in the glossary of offences

There are a few new definitions of terms that have been added in this Bill, especially to describe the new offences. Among them are the terms:

Cyberbullying

It has been defined as any behaviour by means of information and communication technologies which is repetitive, persistent and intentionally harmful or involves an imbalance of power between the perpetrator and the victim and causes feelings of distress, fear, loneliness or lack of confidence in the victim.

Cyber extortion

It means a form of cybercrime which occurs when a person uses the internet to demand money or other goods or behaviour from another person by threatening to inflict harm to his person, reputation, or property.

Fake profile

An untrue online representation, existent or or non-existent.

Harm

It includes physical, sexual, psychological, emotional or moral abuse, injury, neglect, ill-treatment, degradation, discrimination, exploitation or impairment of health or development.

Pornography

The representation in a book, magazine, photograph, film, computer data or any such other media, a scene of sexual behaviour in any form, that is erotic or lewd and is designed to arouse sexual interest.

Sexual photograph or film

An image or video that depicts nudity or a picture of someone who is engaged in sexual behaviour or posing in a sexually provocative way.

Offences

Misuse of fake profile

Any person who individually, or with other persons, makes use of a fake profile to cause harm shall commit an offence. The penalty can be upto a million rupees fine or a maximum of 20 years imprisonment.

Cyberbullying

Any person who individually, or with other persons, commits cyberbullying, shall commit an offence. The penalty is again, upto a million rupees fine or a maximum of 20 years imprisonment.

Same penalty is mentioned for offences of cyber extorsion, cyberterrorism and revenge pornography.

How these new offences will help deter cybercrime or facilitate the task law enforcement, only time will reveal. In my opinion, new offences won't be of much help if the attitude of cybercrime officers remains the same. Not even a thousand new definitions will help if the officers do not improve their investigation techniques and become accountable.

In 2018 when the ICT Act was amended the then Attorney General, M. Gobin, used the same tune about social media to convince people on how useful the amendment will be to help in cases of online threats such as harassment, sextortion and cyber-bullying. He participated in radio & televised debates (on MBC) and at the University of Mauritius. However, since the amendments were made to the ICT Act, we've seen how poeple voicing out against the government are questioned and/or detained for breach of the ICT Act.

Copyright protection

Downloading pirated software, movies and music

Section 21 of the Bill mentions infringement of copyright and related rights. This section makes the download of music, movies and pirated software a criminal offence liable to upto one million rupees fine or 10 years of imprisonment.

Critical Information Infrastructure & increased penalty

This Bill introduces a definition for Critical Information Infrastructure. The National Cybersecurity Committee will be tasked to select the Critical Information Infrastructures in Mauritius. A system providing life sustaining services (e.g water, health or energy), or has an important effect on the economy, or its disruption could result in massive casualties, will be called a Critical Information Infrastructure.

The penalty for a cybercrime related to a Critical Information Infrastructure is twice the fine for other crimes described in the Bill, i.e upto Rs 2 million and a maximum of 25 years imprisonment.

Failure to moderate content

The failure to moderate content on a webpage, social media page or any other online platform, after having received a notice from an investigatory authority, will be a crime.

Compelling service providers to provide access to store data or collect real-time data

If this Bill is passed, an investigatory authority upon issuance of a Judge's Order, may compel a service provider to provide access to stored data or record real-time traffic data, within its technical capabilities. Any disclosure of the investigation by the service provider will be considered a crime.

A example of traffic data is the history of your everyday websites and online platforms that you visit, including your mobile internet traffic, phone calls, SMS, etc.

A example of stored data is your email content if your email is hosted by the service provider. If your service provider is in Mauritius and the email service is hosted outside Mauritius, then irrespectively the service provider will be compelled to provide access to the emails.

The National Cybersecurity Committee

The Bill introduces a National Cybersecurity Committee. This committee will be composed of fourteen members including a Chairperson that will be appointed by the Prime Minister. A person from the private sector and another from the civil society will be on this committee and both of them will be appointed by the Minister of Technology, Communication and Innovation. Both persons should have experience in the field of cybersecurity and cybercrime.

All members of the committee will be remunerated.

The committee may call upon people who can be of assistance but those persons won't draw any remuneration nor have any voting right at the committee's meetings.

The composition of the committee seems to be tightly controlled by the minister and the committee will operate in complete opacity, although their decisions will impact everyone who use the Internet and other technological services.

The Computer Emergency and Response Team (CERT-MU)

The CERT-MU is mentioned in Section 38. I read and ignored. In my opinion, the CERT-MU acts like a poster for the government to say that they do cybersecurity stuff. I have plenty of un-answered emails in which I questioned CERT-MU on cybersecurity matters. I believe CERT-MU will have to up the game and be more responsive to people irrespective of their religion, caste, color, political background, bank balance, social status, etc.

Will the possession of certain software be criminalised?

Lastly, Section 13 of the Bill states that any person who intentionally procures for use, a computer system or any other device, designed or adapted primarily for the purpose of committing an offence under the Act shall commit an offence.

Let's take a deep breath. Is this bill going to make Tor, Wireshark, tcpdump, Linux distributions, and tons of other operating systems and software, become tools likely for the purpose of committing an offence?

I quote an officer of the Cybercrime Unit who once stood in front of the magistrate and said:

Investigation has also revealed that Applicant is the head or the king pin of a network, well established network [...] Applicant is himself an IT Specialist with mastery of more than three operating systems, Linux is one of them.

With this kind of mentality where the knowledge of an operating system can make you a prime suspect, imagine the havoc or damage that the officers might cause if they find you in possession of network pentesting tools.

A new legislation with the same understaffed, underskilled and underpaid division will not produce results.

Proof-of-concept proxy shows user account passwords and private photos can be decrypted

Ish Sookun — Wed, 19 May 2021 16:59:46 +0000

Since the publication of ICTA’s consultation paper¹ on proposed amendments to the ICT Act in order to regulate social media, there has been an outcry and a lot of criticism on the measures proposed. Professionals from the ICT industry have raised alarms over the security risks that the proposed technical framework will give rise to. Legal professionals and civil society activists have expressed that the measures are radically dis-proportionate to the problems stated. The proposed measures will heavily affect the individual’s privacy rights.

ICTA issued several communiques² in an attempt to dispel fear and doubt surrounding their proposal. However, those communiques repeatedly stressed only public posts on Facebook will be filtered and decrypted.

For example, in a recent video³ published on ICTA’s website, at 2m3s, they say that ICTA won’t get user password, log in, email, private messages, bank details etc.

In this report, I explain how a proof-of-concept proxy was used to demonstrate the capabilities of the technical framework proposed in Section 11.2 of the consultation paper.

Disclaimer:
The purpose of this report is purely educational and written to demonstrate a specific context. Any misuse of the knowledge of the software or technique described in this report cannot be held against the author, i.e Ish Sookun. If you continue to read, you acknowledge having read this disclaimer.

ICTA's Proposed Technical Framework

These three steps are the most important ones that are mentioned in Section 11.2 of the consultation paper and my proof-of-concept will focus on these steps only.

install a Certification Authority (CA) root certificate in web browser,
route requests for facebook.com to a proxy server,
decrypt the HTTPS requests.

Software & Technique

I used Fiddler Everywhere⁴ v1.6.0, Mozilla Firefox⁵, Ubuntu 21.04⁶ and a My.T Internet connection.

Fiddler generated a CA Root certificate which was added to the certificate store of Firefox. Then, Firefox was configured to use the Fiddler proxy.

All web requests, i.e HTTP and HTTPS requests, were intercepted by the proxy. HTTPS requests to and from different websites were decrypted in real-time.

I used my own Facebook, Messenger, Instagram, Twitter, LinkedIn, Gmail and Hotmail accounts in this experiment.

Results

I sent the photo of a lazy panda to my wife on Facebook to see whether this private message will be decrypted by the proxy.

Yes, the private message was decrypted by the Fiddler proxy and the photo appeared exactly as I sent.

Next, I tested messenger.com and the first thing I noted was that the proxy decrypted my login and password.

The email field contained the login. Both login and password were exactly what I typed in the login page of messenger.com. I blurred the fields in the screenshot for obvious reasons.

I tested Instagram to see whether a picture that my wife sent me would be decrypted the same way the proxy did for the Facebook private message.

Yes, the picture of the adorable Quokka was decrypted by the proxy, as you may see in the above screenshot.

I tested Twitter and I could see my login, password and direct messages in clear text.

Twitter DM decrypted by the proxy

Lastly I tested Gmail, Hotmail and LinkedIn. The login and password of all three platforms appear in clear text.

You will notice that Firefox never prompted me about any untrusted connection while the proxy decrypted the HTTPS traffic.

See above, the padlock will give you the impression that the website is genuine and it can be trusted. However, the certificate is issued by Fiddler and signed with "DO_NOT_TRUST_BC".

Facebook.com is signed by DigiCert and not DO_NOT_TRUST_BC.

Lastly, without decryption there is no way to identify what content the user is accessing on Facebook because all traffic will appear as facebook.com:443.

As seen above, all Facebook traffic end with :443 because the complete URL is encrypted. There is no means to know where does facebook.com:443 lead to, whether it leads to facebook.com/public-post or facebook.com/private-content. To obtain the URL information, the entire Facebook traffic will have to be decrypted. This means decrypting login, passwords, public posts and private messages in the process.

Login details, passwords and content sent via private messages can be decrypted by a proxy that is trusted by the web browser. At no point the browser will notify that the website being visited is being proxied and decrypted.

Therefore, if someone starts with decrypting facebook.com today and tomorrow decides to start decrypting gmail.com, the Internet user will not know that this is happening.

Credits to S. Moonesamy for mentioning a proof-of-concept proxy in his slide decks⁷ on Unsafe Web Browsing in Mauritius.

Cover photo by Etienne Girardet on Unsplash.

Mauritius: Cybersecurity Bill

Ish Sookun — Sat, 26 Sep 2020 06:53:46 +0000

The Minister of Technology, Communication and Innovation (TCI), Deepak Balgobin, announced that the Cybersecurity Bill will be introduced to the National Assembly of Mauritius as parliament resumes on the 3rd of November 2020.

I haven't heard about any public consultation regarding this bill, neither have I heard from anyone from the local tech user groups speaking about it. Therefore, I am assuming that none of the active user groups of Mauritius were invited to share their opinion on a legislation that could affect a whole community of internet users in the country.

Copying & pasting a legislation from other parts of the world is not a solution.