Super User is a question and answer site for computer enthusiasts and power users. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

My new company has a monitor position. What a monitor does, is to monitor what anyone is doing. No IM, USB, phone with camera are allowed. I wonder within a WLAN, if a monitor can intercept my email, and see its content? Can he see my what I am browsing? Is it possible to use SSH to bypass all the data packages intercepting ?

share|improve this question

migrated from Jun 21 '10 at 8:15

This question came from our site for professional and enthusiast programmers.

I hope you did not post this from work, or now they'll watch you even closer. – Redlab Jun 21 '10 at 8:12
Remember too that this monitor has to justify his existence. A nice, juicy policy violator is his raison d'être. So not only is your monitor well placed, he's strongly motivated. – msw Jun 21 '10 at 8:42
Yes man, I said my new company, I am not in there now, lol. – Sawyer Jun 21 '10 at 8:56
I presume that attempting to circumvent your monitoring policy is itself a violation of the policy? They'll eventually catch you. "Hey, so why does this guy have 2 gigs of ssh data in and out every hour?" – msanford Jun 27 '10 at 22:44
Tunnel traffic through ssh if you reallllly need a way. – Chris Aug 26 '10 at 20:44
up vote 8 down vote accepted

Yes, all communications out of the LAN will go through the firewall and can be intercepted/monitored.

Encryption is one way to "hide" such communication, but it seems to me that if they're that paranoid about spying on you, then they'd simply block all encrypted connections anyway.

I would suggest that you do not try to circumvent their monitoring. If you don't like what they're doing, then you're free to find another job. While I certainly don't agree that limiting employee access to "personal" use of the internet is a good idea, companies are free to implement whatever policies they like and your circumvention of that policy could certainly be cause for dismissal.

share|improve this answer
+1 "if they're that paranoid about spying on you, then they'd simply block all encrypted connections anyway" – msanford Jun 27 '10 at 22:42
Depending on your jurisdiction, law might prevent them from monitoring everything or even anything. However, since you obviously chose to work there, legal might not be the way to go. Also, IANAL. – Daniel Beck Aug 26 '10 at 22:16

If they have physical access to place a monitor node between the gateway and the switch or router that serves up your IP address, they have the ability to capture any data you send across the net.

For example: To monitor eMail data being sent across the pipe:

  • create a port sniffer that captures packets for all the data being sent across SMTP (port 25) for outgoing messages and/or POP/IMAP for incoming messages.
  • organize the emails based on their origin (IPAddress)
  • x-ref the captured emails against a data base that maps IP addresses to employees within the company
  • parse the actual email message out of the SMTP packets
  • organize the messages in a system that makes it easy to search/read/crawl/etc the email messages

Web browsing is similar:

  • use a port sniffer to capture data coming in on port 80 (HTTP)
  • map the data-to-user relationship using a database of IPAddress-user data
  • parse the data using a browser or a custom-built crawler or just store the address of the sites being visited by pulling the URI from the HTTP header

It's really not that hard to do, especially since all email and HTTP typically aren't encrypted.

There are ways around such a system. Such as using a VPN, or encrypting your data and encapsulating it in one of the protocols that aren't blocked on the firewall (ex. HTTP) but it would require a certain level of programming skill as well as knowledge of the networking domain. Plus, if you use something that doesn't get transmitted across one of the 'usual' networking ports (HTTP, SMTP, POP, IMAP) you might get red-flagged and/or blocked/investigated by the person doing the monitoring because of 'suspicious' activity.

Networking-security specialists usually know a lot of little tricks to find ways around a system. Unfortunately, a general systems programmer wouldn't know them because they usually take an intimate knowledge of the protocols and their vulnerabilities.

You can 'tunnel' encrypted data through a standard port using SSH but it requires that you have a dedicated SSH server running in a remote location. Just remember that, they can see everything you send across the net. If they consistently see gibberish (encrypted data) being sent across the pipe, you'll probably/eventually get red-flagged for it. Otherwise, they wouldn't go to all the effort to dedicate a person to monitoring the connections.

share|improve this answer

Thats a pretty big question, look at the capabilities of products like "IronPort" and see how anonymous you feel. :-) It's a really bad idea to try to subvert your employers security policy.

share|improve this answer

A new firewalls now also support SSL interception that means they can even see your HTTPS data now, however this is not legal in some countries, but yes almost all communications can be logged and monitored with firewalls.

share|improve this answer
They can see your HTTPS data - but the original SSL certificates will be invalid. In a controlled setting (such as the OP's workplace), it is possible to add a company-internal root CA to everyone's browser and re-sign the stream with that; that way, SSL cert will be valid, but it will be different from the certificate seen normally from that site. – Piskvor Jun 21 '10 at 8:02

First of all, being able to circumvent policy is not the same as allowed to do that, and different yet from a good idea: I'm pretty sure, with such policies, circumventing them would be punishable.

  • e-mail: Certainly intercepted
  • browsing: Almost certainly intercepted
  • SSH and other workarounds: might work, but if USB devices and smartphones aren't allowed, I'd guess outbound communication will be limited (i.e. "it probably won't work"). Also, might not be allowed.

Even if you manage to get a tunnel up, passive traffic analysis will flag you: "This Tony guy has no outgoing connections, except these: long-lived, all to the same host, high-traffic, encrypted." Good luck persuading your employer ('s lawyers) you were not squirreling away the company's databases (having willingly and knowingly circumvented company policy isn't going to win you any points either).

share|improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .