28c3 LT Day 4: Introducing CrossBear - Hunting the TLS Men-in-the-middle
Channel: 28c3
Date: 01/01/2012

The sorry state of the X.509 PKI for the WWW is well-known, and in the past year several studies have been conducted, including our own work (the SSL Landscape). An interesting question is now how often users actually encounter Man-in-the-middle attacks on their SSL connections. There have been credible, yet often anecdotical reports from several sources. In this talk, we present CrossBeasr, a little tool that attempts not only to detect but also locate a Man-in-the-middle. Its primary purpose is to collect data about the MitM, so we can finally say whether we're dealing with a real problem or jumping at shadows. CrossBear combines independent and distributed certificate checks (like Moxie's Convergence or CMU's Perspectives) with a distributed setup that allows us to trace the Man-in-the-middle. Our tool is intended for the savvy user, especially the travelling hacktivist. The more users the system can attract, the better our data basis is going to be. Note: we cannot cover the privacy issues in this talk, but we're happy to have a chat at 28C3.

http://twitter.com/crossbearteam
http://pki.net.in.tum.de