Blue Coat Blog

This is a great talk about some of the methods China and other governments use to block the Tor network: https://www.youtube.com/watch?v=GwMr8Xl7JMQ It's a pretty sophisticated arms race that's lead to some cool stuff, notably pluggable transports (like the obfsproxy you mentioned): https://www.torproject.org/docs/pluggable-transports.html.en Unfortunately the companies that enable this deep packet inspection are often American companies working overseas. My friend who used to work at Cisco said they had internal slide decks about the improvements they could make to the Chinese firewall. Then there's Bluecoat in Sunnyvale (https://www.bluecoat.com/) building the censorship systems for the middle east. Why do American companies sell this kind of stuff to China and non-democracies in the middle east? They must rationalize it in someway, but I think it's wrong.

From https://www.bluecoat.com/products-and-solutions/ssl-visibility-applian… > "Enterprise class Blue Coat’s SSL Visibility Appliance is comprehensive, extensible solution that assures high-security encryption. While other vendors only support a handful of cipher-standards, the SSL Visibility Appliance provides timely and complete standards support, with over 70 cipher suites and key exchanges offered, and growing. Furthermore, unlike competitive offerings, this solution does not “downgrade” cryptography levels and weaken your organization’s security posture, putting it at greater risk. As the SSL/TLS standards evolve, so will the management and enforcement capabilities of the SSL Visibility Appliance."

You are getting into dangerous territory if you want to MITM so many HTTPS connections. (You can do anything with HTTP you want. Starting with DNS blackholing is best) Note that the software GP linked to doesn't (can't) strip ads off an HTTPS connection[1]. It can only completely block it. So for ads + content from a single origin, you can't do anything. If you really want get into individual HTTPS connections, you'd have to install a root cert into every single once of the computers and MITM them by presenting your cert. This is only done in scenarios where one has to control everything the client machines do. Otherwise you're (much) better off preinstalling uBlock Origin on all the computers. BlueCoat is a company which works in this space[2] (it acquired by Symantec last year). Even then, you risk breaking something sometime[3] [1]: https://www.privoxy.org/faq/misc.html#SSL [2]: https://www.bluecoat.com/support-services [3]: https://news.ycombinator.com/item?id=13750379

The prolific SEA[1] has been responsible for many hacks when their aim went wider than tracking domestic dissidents via internet monitoring with hardware from BlueCoat[2]. Logs[3] leaked by dissident supporting Telecomix[4] from this BlueCoat hardware for example show filters set to monitor the religious and sexual habits of all traffic routed through the datacenter they were installed in. After Assad deployed his military forces SEA started to become a more public facing entity, taking on media firms due to perceived slights in reporting and others to cull more user information to further track targets. A short time-line from Wikipedia: April 2013: The SEA hijacked the Associated Press Twitter account and falsely claimed the White House had been bombed and President Barack Obama injured. May 2013: The ITV news London Twitter account was hacked on the 24th May 2013 by the SEA. The Android applications of British Broadcaster Sky News were also hacked on 26 May 2013 on Google Play Store. July 2013, Truecaller servers were allegedly hacked into by the Syrian Electronic Army. August 2013: Advertising service Outbrain was hacked by the SEA via a spearphishing attack. This allowed them to place redirects into the websites of The Washington Post, Time, and CNN. Their history has been starkly pro-Assad, even going as far to defend indiscriminate bombing runs on the more rural cities in Syria of which the hackers are not likely to live in. While villages far away from the…

Google is singled out due to the humans behind the corporate facade complying, no one forced them to. I would hate to reduce it to binary but things like installation of proxy hardware (Blue Coat[1]) to monitor with or court orders for conscription of local hardware are. Without people collaborating along with the US government, then people... wouldn't be collaborating. Those within the USG would be forced towards alternative routes such as those detailed in the PRISM slides. Bonus: Security creates insecurity, all this logging and data collection creates more data. This data, which Snowden's Booz Allen Hamilton has shown[2], can be leaked. As an example a look into the Blue Coat logs leaked[3] from Assad's Syria by extraordinary esoteric activists Telecomix[4] reveals followers of Christianity along with homosexuals intently monitored. Bonus Caution: I wouldn't touch the Booz or HBGary leaks unless you like federal prosecution for assisting in dissemination of data on the profiteering collaborators[5]. [1] http://www.bluecoat.com/ [2] https://thepiratebay.sx/torrent/6533009/Military_Meltdown_Monday__Mang… [3] http://bluesmote.com/ [4] http://www.theguardian.com/technology/2011/jul/07/telecomix-arab-sprin… [5] http://motherboard.vice.com/blog/the-doj-is-suing-barrett-browns-intel…

Yes they have a cloud service: https://www.bluecoat.com/products-and-solutions/global-cloud-operation… In fact, other than running a legit CA service, using this intermediate CA to intercept and decrypt traffic on their cloud is the only acceptable use of the intermediate CA I can think of, as long as they disclose to their cloud customers that they MitM TLS connections. After all, Blue Coat's cloud is their network, so they have the right to operate it the way they want. Any other use of the intermediate CA would be highly irresponsible/dangerous. For example if they used it in their SSL Visibility Appliance, any owner of the appliance could extract the CA private key from the appliance.

Search for things like “data loss appliance”. As an example, when BlueCoat isn't helping repressive regimes spy on their citizens, they're helping businesses watch every outgoing packet: https://www.bluecoat.com/products/dlp “Blue Coat DLP allows you to easily create policies that analyze the data source, content, destination and more. … accurate data “fingerprinting” capabilities, in addition to powerful keyword, pattern, and regular expression support, so you can create precision policies to effectively secure your data while minimizing false positives.” Sure, the every HN reader might have questions about this but I'd bet a LOT of C-level executives are receptive to this.

A browser plugin is really really obvious, whereas if you take a look at the CA's in firefox - there's hundreds. All you need is one subtly different from what's expected - barely noticeable. https://www.bluecoat.com/products/proxysg I think you'll find the above product interesting. Apparently anti-virus vendors have similar programs - to prevent malware being downloaded over https behind a corporate proxy. It seems that CDN's such as cloudflare and akamai take the websites SSL _private_ keys too. http://blog.cloudflare.com/introducing-strict-ssl-protecting-against-a… This blog post is a fancy way of saying that cloudflare content serving customers now have the option of encrypting the link between cloudflare and them. Note that users can still be MITM'd at the cloudflare site - even with the new arragement.

SEA has a history of doing much more than attempting to offset perceived propaganda[1]. With in that site is dozens of gigabytes of logs from Bluecoat[2] proxy hardware that sat in datacenters for Syrian ISPs. A good amount of what is contained in the logs is things like porn searches, more porn, porn. But amongst the typical naughty bits things like religious queries for Christians, Catholics, Jews, Muslims were being recorded. Telecomix[3] helped to leak the log-set, and as it stands it is _the_ example of how state entities monitor peoples of 'interest.' Much of these people are long since dead, killed early on as they were the most public[4]. So while the SEA's most public facing events are hijacks, phising, and massive redirects. Please do focus on the end result of pervasive surveillance[5]. [1] http://bluesmote.com/ [2] http://www.bluecoat.com/ [3] http://en.wikipedia.org/wiki/Telecomix [4] http://en.wikipedia.org/wiki/Ibrahim_Qashoush [5] http://imgur.com/gallery/qz7wm