There is software installed on all client machines for DLP (Data Loss Prevention) and HIPAA compliance. Supposedly it can read HTTPS data clearly. I always thought that between the browser and the server, this was encrypted entirely. How can software sneak in and grab this data from the browser prior to it is encrypted or after it is decrypted? I am just curious as to how this could be possible. I would think that a browser wouldn't be considered very secure if this was possible.
Software installed on the client can access data before it is encrypted (or after it is decrypted) by modifying or hooking into browser code. Numerous methods of injecting code into the browser exist, including Browser Helper Objects (Internet Explorer) or extensions (other browsers).
In addition to data loss prevention software, malware that steals online banking credentials, including Zeus, uses this "man-in-the browser" technique. Some malware even uses a kernel-mode rootkit to avoid detection.
Note that other methods of sniffing HTTPS traffic also exist, including the addition of a "trusted" CA (certification authority) to the browser to make a man-in-the-middle attack possible. (In at least one case, an established CA actually signed such a subordinate CA, making installation of the certificate unnecessary for a successful attack.)
I believe it is possible to sniff the connection via a proxy, but is not possible to see the encrypted data. It would have be prior or post encryption.
Here is one analogy as to what transpires during a https connection: