Schoolsbroadband - SSL Inspection

[andy_b]

Don't know if I am loosing my mind, but we have just noticed that our SBB connection provides access to a surprising number of websites without the browser complaining about certificates - this is without their SSL inspection certificate installed.

 

Which suggests to me we are not getting a proper SSL inspected connection.  It is hard to say if this is new, because typically we don't browse without the certificate installed.  I know a few sites (most microsoft) used to bypass SSL inspection, but the current testing suggests a lot of sites bypass inspection. 

 

e.g:

 

cert warning - google.com. youtube.com, en.wikipedia.org

 

No cert warning - gbnews.com, aliexpress.com, aljazeera.com, bbc.co.uk - the list goes on

 

SSB block page - 888.com (etc)

 

We've checked the actual certificates presented by the browser. GB News presents a certificate issued by GlobalSign nv-sa both with and without the SBB certificate installed. Google, by contrast, produces a certificate error without the SBB certificate and presents an SBB certificate when it is installed.

 

Is this the same for others?  Because it does seem a number of sites are getting bypassed.

 

[tom_newton]

It's likely they are doing selective MITM - only inspecting sites where it's "interesting" to MiTM (eg sites where you might post/get search terms, and herefore have useful alerting data). This can improve performance in web filtering, but of course doesnt make things much easier as a device with no cert soon wanders into difficulty on one of the "interesting" domains.

[andy_b]

There is definitely something selective going on.  It would be nice to understand what.

 

From a little testing it seems that generally search engines (and youtube) look to be MITM'd and everything else is ignored.

 

 

[sigma]

What you are seeing is the normal SBB setup.

 

They did selective SSL inspection for us and tended to make tutting noises if I started asking about full SSL inspection.  When we moved to LGFL and full inspection, it worked very well.  Netsweeper is very capable of working out what should be allowed or denied based on category rules on different pages of a domain provided full decryption is implemented.

 

For SBB

gbnews.com, aliexpress.com, aljazeera.com, will be in category allows, only filtered at the domain level and not url inspected.  That effectivly means that cannot report on urls accessed for those domains.

 

888.com will be category Gambling  and blocked.

 

SBB should be able to provide you copies of all the lists (particularly allows) they apply on your behalf. The selective SSL list was mainly porn and CSAM - fortunately, most domains no longer exist, but the site names were not ambiguous.  I was never given a satisfactory answer as to why "they" were inspected and not just blocked.  

 

For our last year with them, I dumped all the SBB provided lists and rolled our own including adding sites we wanted decrypting so we could variously allow some pages and deny others. 

 

We found SBB had a nasty habit of dropping either "wholeword" or "keyword" allows into their lists which effectively allowed anyone to bypass filtering for any search term combined with these.

 

You might find it useful to run your own reports rather than relying on what you are provide with.

 

Edited yesterday at 17:56 by sigma
Added clarity hopefully.

[andy_b]

2 hours ago, sigma said:

What you are seeing is the normal SBB setup.

 

They did selective SSL inspection for us and tended to make tutting noises if I started asking about full SSL inspection.  When we moved to LGFL and full inspection, it worked very well.  Netsweeper is very capable of working out what should be allowed or denied based on category rules on different pages of a domain provided full decryption is implemented.

......

 

 

Fair enough.  Somehow we had never noticed the lack of full inspection before. I was convinced something was different as I wasn't using a search engine it took a full 30mins before I noticed I didn't have the SBB cert installed.

[Davit2005]

Certainly sounds like categories to me. When we used to run decryption on our own firewall at a previous place only categories of Medical and banking were defo not decrypted, they could only be decrypted by explicit confirmation by the organization to the third party supplier.