Our company claims that the DLP system can even monitor the contents of HTTPS traffic, how is this possible?

Question

There is software installed on all client machines for DLP (Data Loss Prevention) and HIPAA compliance. Supposedly it can read HTTPS data clearly. I always thought that between the browser and the server, this was encrypted entirely. How can software sneak in and grab this data from the browser prior to it is encrypted or after it is decrypted? I am just curious as to how this could be possible. I would think that a browser wouldn't be considered very secure if this was possible.

Answer 1

Software installed on the client can access data before it is encrypted (or after it is decrypted) by modifying or hooking into browser code. Numerous methods of injecting code into the browser exist, including Browser Helper Objects (Internet Explorer) or extensions (other browsers).

In addition to data loss prevention software, malware that steals online banking credentials, including Zeus, uses this "man-in-the browser" technique. Some malware even uses a kernel-mode rootkit to avoid detection.

Note that other methods of sniffing HTTPS traffic also exist, including the addition of a "trusted" CA (certification authority) to the browser to make a man-in-the-middle attack possible. (In at least one case, an established CA actually signed such a subordinate CA, making installation of the certificate unnecessary for a successful attack.)

Answer 2

I believe it is possible to sniff the connection via a proxy, but is not possible to see the encrypted data. It would have be prior or post encryption.

Does https prevent man in the middle attacks by proxy server?

Observing an HTTPS connection... decrypt it?

Here is one analogy as to what transpires during a https connection:

Imagine a lock-box, the kind with a metal flap that you put a padlock on to secure. Imagine that the loop where you put the padlock is large enough to fit two padlocks. To securely exchange send something to another party without sharing padlock keys, you would

1. put the "Thing" in the box, and lock it with your padlock.
2. send the locked box to the other party.
3. they put their padlock on the loop also (so that there are two locks on it), and return the double-locked box to you
4. You remove your padlock, and return the now singly-locked box to them.
5. they remove their own lock and open the box.

With encryption the locks and keys are math, but the general concept is vaguely like this.