Re: SSL MITM attack by a Tor exit

2009-09-07 Thread Matej Kovacic 
Hi,

 Some interesting information about the self signed certificate:
 
 CN: Finjan.com

Could be that provider of this exit point uses some network appliance.
Some special firewall with antivirus, etc. protection, so called UTM
(Unified Threat Management) device, which does traffic interception only
to check for viruses or malicious code.

Net neutrality ftw!! :-))

bye, M.

SSL MITM attack by a Tor exit

2009-09-06 Thread Tom Hek 

Hello everyone,

The Tor exit JustaNode (fingerprint:  
dcc1c3f96b8459dc7a88e711f9cb2416126eb9d6, http://torstatus.blutmagie.de/router_detail.php?FP=dcc1c3f96b8459dc7a88e711f9cb2416126eb9d6 
) does a MITM attack on every SSL connection. The SSL certificate is  
self signed for every SSL'ed website you want to request. I think this  
exit must be marked a BadExit.


- Tom

Re: SSL MITM attack by a Tor exit

2009-09-06 Thread Quertyf 
Some interesting information about the self signed certificate:

CN: Finjan.com
OU: Vital Security
E: sale...@finjan.com
L: Netanya
ST: Sharon
C: IL

On 9/6/09, Tom Hek t...@tomhek.nl wrote:
 Hello everyone,

 The Tor exit JustaNode (fingerprint:
 dcc1c3f96b8459dc7a88e711f9cb2416126eb9d6,
 http://torstatus.blutmagie.de/router_detail.php?FP=dcc1c3f96b8459dc7a88e711f9cb2416126eb9d6
 ) does a MITM attack on every SSL connection. The SSL certificate is
 self signed for every SSL'ed website you want to request. I think this
 exit must be marked a BadExit.

 - Tom