Yes, you're right. It is MITM: WebWasher (WW) generates cert for destination site and send it to the client, so client thinks that WW is Web-server. The trick here is that if WW's cert is issued by trusted CA, client will not get any warnings.
--- Best regards, Sergey V. Soldatov. Information security department. tel/fax +7 495 745 89 50 tel +7 495 777 77 07 (1613) > -----Original Message----- > From: [EMAIL PROTECTED] > [mailto:[EMAIL PROTECTED] On Behalf Of Devrim Kalmaz > Sent: Monday, September 25, 2006 1:58 PM > To: [email protected] > Subject: [ISSForum] Abour Ssl Scanners And ISS Proventia > > Hi all > > Webwasher has an ssl scanner and claims that it find viruses > and spys in the https traffic. > > I can't find any document about how scanner can do that. > > I think it decr. the https and scan the data and then encr. > it again with self CA trusted cert.So a kind of MITM attack.Is it so? > > And also ISS proventia has capability of analyze MITM attack > but can proventia analyze ssl traffic (the same way of > webwasher do or ?) to find attacks ? > > Thanks > > Devrim KALMAZ > > > _______________________________________________ > ISSForum mailing list > [email protected] > > TO UNSUBSCRIBE OR CHANGE YOUR SUBSCRIPTION, go to > https://atla-mm1.iss.net/mailman/listinfo/issforum > > To contact the ISSForum Moderator, send email to [EMAIL PROTECTED] > > The ISSForum mailing list is hosted and managed by Internet > Security Systems, 6303 Barfield Road, Atlanta, Georgia, USA 30328. > _______________________________________________ ISSForum mailing list [email protected] TO UNSUBSCRIBE OR CHANGE YOUR SUBSCRIPTION, go to https://atla-mm1.iss.net/mailman/listinfo/issforum To contact the ISSForum Moderator, send email to [EMAIL PROTECTED] The ISSForum mailing list is hosted and managed by Internet Security Systems, 6303 Barfield Road, Atlanta, Georgia, USA 30328.
