Super User is a question and answer site for computer enthusiasts and power users. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have networking monitoring software installed on my computer - LittleSnitch for the Mac.

Now let's suppose I go to Amazon and enter my credit card info.

If LittleSnitch is actually corrupt (in my case I can't tell if it is or isn't corrupt) and secretly tries to send this data to the Russian Business Network, would they be able to do anything with that data since it was entered over a secure connection to Amazon?

Is it true that they would they also need the security certificate from my machine in order to be able to interpret the data correctly?

Help me figure out what the worst case scenario is if my copy of LittleSnitch has been corrupted and I've been using it to carry out secure transactions online.

share|improve this question
+1. Interesting questions resulting on different opinions :) Well done! – A Dwarf Oct 3 '09 at 23:20
If you believe your Little Snitch installation has been modified, why not re-install it? 2.2 was released a couple weeks ago. – Chealion Oct 3 '09 at 23:48
up vote 4 down vote accepted

Depends on what 'corrupted' is in your case. If the application has been modified and it (or whatever malware it was packaged with) is logging keys, they don't need to decrypt anything, they have your data in plain text. If the site is making a secure connection with a valid certificate you should be fine. They would need the certificate key to decrypt the data if it's only obtaining it from sniffing the wire after being sent.

share|improve this answer

If LittleSnitch (Just looked it up, seems to be a firewall), is corrupt, there is no reason it couldn't...

SSL makes it harder to intercept, but if you install any sort of local program, it can easily keylog your session and send that to whoever.

Also, you can have SSL man in the middle attack...

Any program can be hacked, cracked, or anything - If you don't trust it, don't run it... Don't buy into the MAC's are hacker/virus proof. If you run any sort of local "executable" or "script" it can do ANYTHING that you can - rewrite system files, intercept etc.

share|improve this answer
Well, +1 for me. Although I don't fully agree with a few parts, it's definitely not a -1. Unfortunately some people seem to enjoy abusing the voting mechanism – A Dwarf Oct 4 '09 at 0:02
Let me clarify the problem with both yours and Johns answer is the idea of a keylogger as an external application to the browser. On this case the idea that a browser such as Safari, Firefox, or IE would be vulnerable to a keylogger coming from a LittleSnitch. I'm sorry but, it's just not possible. Unless you have knowledge I don't have, in which case I would really like to know about. – A Dwarf Oct 4 '09 at 0:09
Regarding HTTPS, I don't think you are correct... The connection to the server (or proxy server, or even man in the middle!) is encrypted, but the actual process itself is not in anything higher than a standard process. Keyloggers typically go at a lower level / tie into kernel processes and would be able to intercept any key pressed. (in the same way as if you have a keyboard with custom buttons and an on screen display, you can make it display special stuff). – William Hilsum Oct 4 '09 at 0:23
hate jump in, but: a keylogger would be intercepting keystrokes at the OS level, before the application (browser) gets it, and so could copy your keystrokes (CC data) as you type, before the browser encrypts & transmits the data. "special security GUI controls" smells like snake oil. – quack quixote Oct 4 '09 at 1:45
@A Dwarf: my apologies, that wasn't meant as a personal attack. i mean "snake oil" in the sense of security "features" being hyped that aren't terribly effective -- Schneier uses the term a lot. if you were referring to specific features that are not snake oil, that's fine. sorry my comment was insulting. – quack quixote Oct 4 '09 at 4:54

I have networking monitoring software installed on my computer

If suspect software is installed on your client machine, you have already lost. It could, for example, copy an RBN Certifying Authority into your user's list of web browser trusted CAs, allowing them to spoof any HTTPS site. Or it could log keypresses, or take pictures of the screen, quite independently of any functionality related to LittleSnitch.

HTTPS protects against man-in-the-middle attacks: if your man-in-the-middle is suspect software on your router or gateway, HTTPS is secure. However it does not and cannot protect against the HTTPS-using client machine itself being compromised.

share|improve this answer

A hacked version of your firewall (on this case, LittleSnitch) would not be enough for the personal data being transmitted through a HTTPS connection to be decoded. Sure, LittleSnitch could send it to anywhere the hacker made it go. But by the time the firewall captures the data that is being sent to the secure server, it has already been encrypted. Only with the correct certificate and installed on the correct server address, would the hacker be able to decrypt the data. This is one of the reasons why HTTPS is secure against middle-man attacks.

If however you are working under a hacked browser, that's a different matter. A hacked browser could be logging your data as you enter it and secretly send it through a hacked LittleSnitch purposely made to not inform you of this transmission.

share|improve this answer
What does "installed on the correct server address" have to do with it? If you're decrypting a compromised transmission, the app your doing it with will not be following normal procedures of checking the certificate is on the correct host, etc. It will just do anything it can to pull out whatever it can. – Samuel Jaeschke Oct 4 '09 at 7:41

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .