UC Berkeley profs lambast new “black box” network monitoring hardware

Re:UC Berkeley profs lambast new “black box” network monitor... by thetruthseeker1 on Monday February 08, 2016 @01:31AM (#11056654)

The title of the article wasn't very worrying to me, so I read the whole article, and I was trying to figure what in this article is actually a cause for concern. I actually didnt find any "significant" cause of concern.

I have worked in the area of computer networking for many years. My guess is, one of the things the black box product is doing is typically looking for TCP or IP traffic patterns(packet flow patterns) that indicate say command control type of malware, or other malwares, that don't have much resemblance to packet flow signature of user browsing activity.

Also, this blackbox won't be able to decode HTTPs anyway. So may not be a privacy concern for most people?

[ Parent | on HN ]

Re:UC Berkeley profs lambast new “black box” network monitor... by nindalf on Monday February 08, 2016 @05:48AM (#11057403)

My understanding is that it can decode all HTTPS traffic because it acts as a Man-in-the-Middle. Traffic from the client to the Fidelis device is encrypted with a Fidelis certificate. Its decrypted at the device, encrypted again with the actual certificate and sent to the destination. If it couldn't do this, I think it would be impossible to distinguish benign traffic from malicious traffic.

[ Parent | on HN ]

Re:UC Berkeley profs lambast new “black box” network monitor... by tommica on Monday February 08, 2016 @01:48AM (#11056686)

I might have misunderstood completely, but if this one is in between the packages, why couldn't it do some MITM attacks?

[ Parent | on HN ]