yashsingh1/xdaforums huggingface dataset:
[Android Software/Hacking General [Developers Only]] Jaruamana:
Firefox is going to make installing & using of certificates like keweo more annoying

Firefox is going to make certificate install more annoying.

" In Firefox 61, Mozilla added a new error message called "MOZILLA_PKIX_ERROR_MITM_DETECTED" that warns a user that a program is attempting to perform a man-in-the-middle SSL attack. In Firefox 65, Mozilla has revised the accompanying info to explain that software, such as an antivirus program, could be the cause of this error.

A man-in-the-middle (MiTM) attack is when a program adds their own certificate as a certificate authority in the browser so that it can listen in on, or sniff, the encrypted SSL traffic between your browser and an SSL encrypted site. This allows the program to see all the transmitted traffic between your browser and the site, including passwords, entered financial information, or any other transmitted data.

In order to make it easier to understand and allow users to see what certificates may be attempting to perform a MiTM attack, Firefox has changed the information that is used to describe a MOZILLA_PKIX_ERROR_MITM_DETECTED error.

Firefox 65 to add more detailed info in error message

In Firefox 64 and below, when a certificate is used in a MiTM attack the browser would simply display an error stating "Warning: Potential Security Risk Ahead". It did not, though, provide any real information regarding what certificate is causing the error, which is pretty useless for most users.

Firefox 64 MiTM Warning

Firefox 64 MiTM Warning

In Firefox 65, a new error message has been added that is much more descriptive and includes information regarding the specific certificate that is being detected as performing the MiTM attack. This will allow a user to determine if it's a program they are intentionally using such as an antivirus software or a web debugger like Fiddler, shown below, causing the error.

Firefox 65 MiTM Error

If Firefox continues to display MOZILLA_PKIX_ERROR_MITM_DETECTED errors, then you have a program trying to inject their own certificates so that they can listen in on your encrypted web site traffic. The problem is that this certificate is not trusted by Firefox, so it displays this error.

Therefore, if you see this error while browsing the web, you need to figure out what program is utilizing this certificate so that your data is not at risk.

If the certificate is from your antivirus program, Mozilla suggests that you disable SSL or HTTPS scanning and enable it again. Doing this should allow the antivirus software to add their certificate to the Firefox certificate store so that it can listen in on SSL connections and not generate a warning.

On the other hand, if you are seeing a certificate that is not from an antivirus vendor, then you need to determine what program is trying to inject the certificate and terminate it. Unfortunately, if its an adware or malware process, determining what software is doing this can be difficult and you should perform a scan of your computer using an antivirus software."
[Android Software/Hacking General [Developers Only]] MrT69:
For Android go to http://pki.keweon.center and wait for the download. Now install it by double click.

For Mozilla and Firefox you need to go again to the website above and just enable "Websites".

Quite easy ;)
[Android Software/Hacking General [Developers Only]] MrT69:
I have no problems when they offer more seucurity. But if this is indeed the fact they drop themselv from the top.

At the moment I can't believe this. This is not a security enhancement this would become a nightmare.
[Android Software/Hacking General [Developers Only]] murali3127:
Sir how can I use keweon with private dns on pie?
[Android Software/Hacking General [Developers Only]] vatsal_chandan:
not supported yet
[Android Software/Hacking General [Developers Only]] Nastrahl:
You can't use it if the DNS server blocks some of Google's tracking server it randomly try to connect to after activating the private DNS option. https://twitter.com/ay_meshkov/status/1075823515876642819?s=19
[Android Software/Hacking General [Developers Only]] trvr73:
Hi MrT69,

Links for certs don't work. I get error 404. Update - Links from #1 don't work, links from #5 work.

And when I set DNS to 213.239.207.143 and go to https:// i.hate. ads, I always get blank screen. Does not matter whether I have cert installed on not. Is it ok ?

Thanks in advance.

Trev
[Android Software/Hacking General [Developers Only]] renema:
I have a question for this theoretic setup

- A user of keowon installed your root certificate

- You set up a server which looks like paypal

- You create a ssl certificate for it with your root ca

- You change the DNS entry for paypal.com to point to your Webserver

- The browser of the user accesses paypal.com, lands on your webserver and doesn't get warned because he has your root certificate

- You could grab his account data.

How could you proof, that this is not possible?

---------- Post added at 02:34 PM ---------- Previous post was at 02:23 PM ----------

And btw. your support group on telegram seems broken
[Android Software/Hacking General [Developers Only]] MrT69:
Quite easy.

1. Take the IP Address 195.201.221.5

2. Add this entire to your Hosts file

3. Now try to open PayPal

If you are now able to log on to PayPal then this would be a wonder. It's technical not possible.

Compare DNS System as a huge hosts file because this was the reason why DNS was invented.

When you block something within a hosts file and you open this with https within the browser you will get an error message because there will be no valid https connection.

I have a few million entries within the database and it also might happens that I do something accidentally wrong. Always expect the worst case. ?

1. Without the certificate you can manually close all the upcoming error messages. But I promises to you after 2 hours surfing online this will drives you crazy.

2. The Certificate Termination is to prevent errors within the browser or within Apps. This has the advantage that your browser becomes faster, it's smoother, it has cosmetic feature and even downloads becomes faster. Why? This is related to OS. Windows and Linux are preemptive Multitasking Operation Systems and they are working with "time slices" to process different threads and processes. Doing, stop, go again. Because of the Design of the OS errors are always processed with a higher privilege. This will cause that one single "time slice" can cause a delay up to 20ms. To prevent this things the certificate is made for this. Nothing more. It's also very easy to confirm this. Open a browser or do it with Fiddler. Take a look at the errors with and without the certificate.

3. If you take a logger or Wireshark or whatever you will see there is also a 0 byte communication. This is related to the fact that the browser receives no error. This always cause the HTTP/200 code which finally means: Everything is OK

4. The idea was born during a business usage. The CIO told me keweon has a huge business need but it's annoying with all the errors. Because of this Certificate I decided never ever to release an App or a Website which will ever use this certificate. A Certificate alone is never able to collect data or to classify or to send Data.

5. There is also a second Server which do the same Job but its a 5 yrs old system. This Server is still in action but for only a almost Google and Amazon Ads Domains because I have no time to extend my termination code at the new Server.

6. Nobody is perfect and although I even have developed some kind of "Filter AI Technologie" it was always one of my top rated goals "expect that **** might happens". It would be a nightmare for the entire solution if e.g. Paypal would be on the Blacklist and it is just only theoretical possible to attack any communication. I spend years in development and I'm working long enough within IT security. I expect that this could happens but it is a MUST that this would be never ever a threat in whatever case I think.

This entire solution is still within a PoC status but not because of the question "Is it safe?". And this kind of security is still within a continuous improvement process.
[Android Software/Hacking General [Developers Only]] renema:
You didn't even read my question, right?

If you WOULD forward someone trying to access paypal.com to a phishing webserver, and if you WOULD give this server a seemingly valid certificate signed by your root ca, how do you want to proof, that you CAN'T read the data sent to this server.

EDIT: Without having to trust you, when you say, you will not do this, of course.

Don't try to impress users with background or your personal achievements. I tried to make a simple theoretical PoC, why this might be insecure and you post tons of text with no context to my question.
[Android Software/Hacking General [Developers Only]] MrT69:
Ohhhh... The same bashimg game as on Telegram now here?

If you have concerns just don't use it. How u make sure that a Router or a Software has not a Backdoor?

It seems you guys are from Ads industry or from Google and at that point I give a huge sh*t on you.

There is never ever a warranty for any software or system because it also can be that you do a download and get an infection.

Trust it or trust it not. But all this Bashing and Mobbing from your or your Team side will never ever cause that I switch the system off.

Do what you want but telling me that all keweon users are stupid because they have no clue what they are doing is a real hard thing.

Whatever I explain to you will be ignored. And posting things like this? What's your problem? Why do you guys try to break this solution down?
[Android Software/Hacking General [Developers Only]] renema:
Oh, so that's why the group in your signature is down? Im sorry to hear, that you got bashed or spammed or whatsoever. I do not try to "bash" you, I only want an answer to my concern. Messing with certificates is a severe risk on security, but surely can be done well. Knowing how this is done securely with a proof for that would help to trust the software.

That's a good question. But has nothing to do with my question again. And yes, I will "just not use it" but anyways, try to get those concerns out of the way by confronting them with facts.

I'm not in any "team" against you. Also I did eiter bash nor mob you. Stay calm.

Getting emotional on this also do not answer my question. I absolutely don't want to tell, that users of your service are stupid.

My "problem" was a simple question regarding the security of keweon users. If you trust in the security of your solution, It should really be quite easy to answer it. If not, your software might sound suspicous and users shall know this. But AGAIN, do not get emotional on this and present facts to answer my question. Not to impress readers with things about how Operating Systems work as an answer to a completely unrelated question.
[Android Software/Hacking General [Developers Only]] MrT69:
Ohhh... That's the bashing team. ;) Sorry...

And this is the DNS Server you provided me. It was just a Proxy Server. Real funny... And you are wondering why I call this guy an idiot? ;)

Oh...sorry. It was a DNS Server which take over it's own IP Address for PayPal. That was your definition and then Aron agreed it's a transparent proxy.

It seems you guys are from the Ads Industrie or from Google. I can't explain it other why you blame so hard against me, keweon and the users. :good:

Now I'm poud of this.
[Android Software/Hacking General [Developers Only]] renema:
That's no bashing eiter, just presenting what is possible for you.

You can be happy, that users trust you, that you would never do this. But you cannot argue, that this is not possible. That was my whole point, maybe you get it now.
[Android Software/Hacking General [Developers Only]] Thespartann:
You are calling this guy an idiot because you like being harsh with people.

No, not the bashing team here. I'm here to share something that could interest users, and also to show you you have a security hole in your own DNS. You denying that doesen't help at all, and bashing us is not useful either.

No we aren't from Google and we aren't blaming your users and neither you, you are blaming us for showing you the possiblilies of a root certificate.

I can't tell you that much about the "Proxy server" you are talking of as i am not it's creator, and anyway, it's been tested already.
[Android Software/Hacking General [Developers Only]] AeolicLavender:
Wrong. Try setting Entry www.paypal.com with ipaddress 51.75.73.216 and install root cert from PoC website.

You'll see your traffic at http://51.75.73.216:10001/
[Android Software/Hacking General [Developers Only]] MrT69:
Oh... Yes. It's a real wonder why it's working with a Proxy and you will see this.

You can do what you want - you will never get my technologie. And if user decides to take it offline then I would rather delete everything then to sell or to make this OPEN SOURCE. I already told you - keweon is NEVER EVER using any kind of Proxy. No DNS Server which take over the domain and use it with it's own IP Address or a transparent Proxy or a whatever Proxy.

It's soooooo incredible about you guys. Telegram, XDA, android-hilfe.de and even a own website because you don't know how it's working. And you are all really hard stalking me ;) Yep, I'm so proud of this!!!

Wait for 2 or 3 more weeks then you have more where you can blame on me *gg*
[Android Software/Hacking General [Developers Only]] Thespartann:
Swearing doesen't help at all. You also should not be proud of bashing any user. We tried to show you a security hole in your DNS, seems like you don't want to accept it.

Fine then, you don't have to, but swearing at users is another level, and it's the kind of stuff neither users and xda team would not want to see on XDA forums.
[Android Software/Hacking General [Developers Only]] renema:
Well now you are talking nonsense AND insulting others. Why are you so emotional if you are so certain about the security of the keweon users?
[Android Software/Hacking General [Developers Only]] AeolicLavender:
It requires no proxy configuration on the client side.

Only DNS and root cert.

It works even with "No proxy" in your browser.
[Android Software/Hacking General [Developers Only]] mattgyver:
Keep it civil, please. You can argue about PoC security holes all day (as enterprise level tech support, I'm all for users having a level of transparency in products they use), but keep the language and lack of respect out of it.

You all had to read the Forum Rules when you joined. This site is used internationally by all age ranges. Offensive language and flaming will not be tolerated.
[Android Software/Hacking General [Developers Only]] vdbhb59:
[MENTION=304818]MrT69[/MENTION]

Not taking it personally here, however, if someone is proving something is wrong, try and accept it, or when you challenge something, live up to it. Like people are saying about your PayPal stuff you spoke about.

On the other hand, prove it to people that they can trust you, rather than being aggressive. That will get you more users and you would earn more respect. Otherwise it will be futile and will prove that you are wrong and hiding something like corrupt people.

For others, instead of playing blame games, assist other users on how to stay safe. At the and of the day, "no one", mark it, "no one" wants to be hacked or lose something in this cracked world.

---------- Post added at 00:28 ---------- Previous post was at 00:26 ----------

That is why I intervened and wrote the above post. ?
[Android Software/Hacking General [Developers Only]] MrT69:
Yep, I know it was not professional and it was my bad.

It's since beginning of November and it becomes harder and harder day by day.

It's a also a hard thing to fight against all this Online threats and data collection. When I'm within this meetings they told me "No Data collection - No Money" because I want to have it bigger. I still believe I'm able to make it bigger because it's a real damn good protection.

In the meantime I also know a lot of people wants to know how it's working because they don't understand this how it's working. Everyone can do it with a stupid Transparent Proxy but this was not my goal. I want it 100% DNS based and it's still 100% DNS based.

It's real frustrating when you try to make the world a better place and then suddenly some guys starting such a campain against me. Germany has the hardest law against Cyber Crime and if I really would do this as this guys are talking about then I would run in serious problems because this is a violence against many german laws. It is not a Proxy. keweon would never be a proxy.

Yep, it was to emotional from my side. I can only say sorry. Damn! Shame on me... Sorry again.
[Android Software/Hacking General [Developers Only]] AeolicLavender:
That Proof-of-concept is 100% DNS-based.
[Android Software/Hacking General [Developers Only]] MrT69:
And why it is able to read password and accounts?

With keweon it's technical not possible. And this is quite easy to test.
[Android Software/Hacking General [Developers Only]] renema:
Keweon makes it theoretically possible to change the IP of a DNS entry and the root certificate makes it theoretically possible to spoof the identity even with SSL enabled.

Again, this does not imply, that you're doing this. But you can't deny these facts
[Android Software/Hacking General [Developers Only]] AeolicLavender:
Root certificate.
[Android Software/Hacking General [Developers Only]] vdbhb59:
Agreed on these facts. Even Daniel is saying that he trusts you, but you need to show it that others too can. Also, in my suggestion as a friend, guide, try and make a poc that shows that 1. You are not doing anything wrong. 2. That the security breach that has been pointed out gets sealed ASAP.

You want people to trust and donate, respect you, do these mate. Anything else that you find enough.

Trust me, bowing is good too.
[Android Software/Hacking General [Developers Only]] Blackeyedangel:
I would think that a practical test would satisfy everyone, would give side a and b an opportunity to prove their statement, and would show if something would be needed to improve, which in the long run is better for everyone's security.
[Android Software/Hacking General [Developers Only]] O l l i X:
It's real frustrating when you try to make the world a better place and then suddenly some guys starting such a campain against me. Germany has the hardest law against Cyber Crime and if I really would do this as this guys are talking about then I would run in serious problems because this is a violence against many german laws. It is not a Proxy. keweon would never be a proxy.

You know.. There's a lot of interests that would love to see this project fail, and shut down! Just a few negative comments from such interests, can demoralize you. That is, if you let them! ☺️

You see, I can say the sky is gray and clouds are blue! Anyhow, reality doesn't care about what I say or even make up!

It's all nothing but words, and they don't make reality.. Reality just, is . . . What you make out of my words, that's up to you though! But never waste your positive wives on stuff that doesn't add anything but negativety! ☺️ You DO make the world a better place, NEVER let anyone make you believe otherwise!
[Android Software/Hacking General [Developers Only]] DrDreed:
I have been observing this as a "silent co-reader" for quite a while now, also on Telegram and in the German forum.

In the german forum users were threatened and insulted by the keweon developer when he was confrontated with the accusations and the attitude of the developer is demonstrably anything but professional.

What I don't understand now is the following:

1. assuming keweon and its developer have only good intentions, why were all support groups on telegram deleted?

2. Why doesn't the developer face the "accusations"?

3. why does the developer threatens users:

"If you knew where I work, would you not allow yourself to question my work?"

4. where does the developer work that one should be afraid of?

State? Police? Intelligence? worse?

5. why does he now post everywhere only under a false name or another account?

6. why does he make a bet and not stand by his word?

7. why didn't he inform users honestly and openly about how easy it is to intercept data with a certificate, e.g. Paypal, to cut data traffic, etc. from the very beginning?

8. it's about user data, sensitive data partly, doesn't that justify from the beginning honestly informing your users about the possible risks?

I would be very pleased about an honest, open and not insulting answer
[Android Software/Hacking General [Developers Only]] vdbhb59:
I honestly do not believe you will get the answer you have thought you will when you wrote this. However, I am hoping Torsten does not break the tree of trust. However, my honest suggestion to all, stop using the cert and check for leaks via some trusted opensource app, if you use Keweon.

Dankeschön

---------- Post added at 22:26 ---------- Previous post was at 22:23 ----------

BTW, Torsten in XDA shows here as a member for a long time. Wish people would see through and wish he will not be what we all think.

However, I am sad seeing his responses and how much audacity is shown by him.

Sad.
[Android Software/Hacking General [Developers Only]] MrT69:
I just write a short "ping" because I want to let you know that I don't hide because of the current situation and everything is fine.

At the moment I have just huge business stress and there will be definitely a statement from my side. I have in addition a Job & Family and I can't act within the speed I would like to act.

;)
[Android Software/Hacking General [Developers Only]] :
I have a few questions for everyone.

1) Is the only concern regarding Keweon the use of the root certificate?

2) Is there a safe way to use a root certificate to accomplish what Torsten wants to accomplish with it--suppressing https errors and cleaning pages?

3) Is there a third party auditing group that could audit Keweon to the satisfaction of Torsten and all other parties?

To my knowledge, nobody has ever claimed to have been compromised with stolen data by Keweon. That doesn't mean a hole doesn't exist. I agree that users should be careful and investigate things further.
[Android Software/Hacking General [Developers Only]] Mackie Messer:
Obviously some people that are not keweon users are reiterativly asking the same questions again and again. Why someone should answer this? How would act a professional company like Google, Microsoft or Apple on comparable questions about theoretical risks or backdoors in there software solutions? Of course they don't getting emotional or taking it personally. They ignore this nonsense. And I'm pretty sure people that ask that questions here are using software solutions from that companies without understanding there code completely.

It's a waste of time to try to convince people that not want to be convinced. Keweon is an offer. Nobody is forced to use it and it seems not no be intended to steal passwords or other informations. But if that would be the case, it would be much easier defend ones rights against one not real anonymous person from Germany than against a big company from USA. Therefore I prefere keweon like it is. If you don't like it, don't use it. Try to develop a better solution o show working alternatives. Only that would be helpful. This forum is primarily for users.
[Android Software/Hacking General [Developers Only]] Illidan Pornrage:
Yo beacherellas, if you got answer-notified, check the subforum if this thread for news regarding this topic!
[Android Software/Hacking General [Developers Only]] AeolicLavender:
Yes.

0.0.0.0

The cert sets him as large target since he can intercept any site.