1

I hope this question isn't considered to "open-ended"...

The company that I work for is concerned about their image and they would like to have more control about the publications into their official social medias. Two major drivers to achieve: gain control over the passwords and inspect texts that are being posted.

My first impulse was to build some kind of proxy and intercept the request (get, post, etc) and change it. For instance, if a tweet has improper words, the proxy could drop the request and return a 403 response...

I did a small PoC using Jetty. I was able to setup a proxy and intercept requests. Manipulate HTTP request/response was easy, but HTTPS is a different story. With Jetty I was able to do only SSL tunneling, the proxy works, but of course I'm not able to "see" the request/response. Is it achievable with Jetty?

I also studied a squid + Internet Content Adaptation Protocol (ICAP) solution. But ICAP open source solutions seem to be very rudimentary. Does ICAP offers this kind of solution?

Another approach is to create an application that uses a façade to specialized clients for each social network. This way I could use httpcomponents/guava to connect to the sites and perform the required steps to publish something.

Has anyone ever had this kind of need and can you help me by pointing out some paths?

EDIT

Googling a little bit more I found that the scenario that I described could be interpreted as MITM attack... OMG...

Improve this question
4
  • 4
    Look into how Fiddler allows the inspection of HTTPS traffic. And yes, you are performing a MITM attack. I hope your company has looked into the legal and social ramifications of this.
    – MetaFight
    Apr 23, 2017 at 9:02
  • 3
    "gain control over the passwords and inspect texts that are being posted." Stop trying to come up with a technical solution to a social problem. Just change the password and don't give it to anyone who can't be trusted with it.
    – Philip Kendall
    Apr 23, 2017 at 10:17
  • If those social media accounts belong to the company, why would you need to intercept traffic? Spying on your own accounts doesn't make any sense.
    – scriptin
    Apr 23, 2017 at 12:37
  • Yes. It's a MITM attack. Here's the moral question. Since these are corporate accounts, doesn't the company have a right to be a legitimate man in the middle?
    – RubberDuck
    Apr 23, 2017 at 15:20

2 Answers 2

Reset to default
1

If you control the client machines, it is possible to implement a proxy for SSL connections by installing a new root signing certificate on the client, and then using that root certificate to sign a certificate for the site that is being visited. This technique is used for example by virus checkers so they can intercept malware before it is delivered to the client.

Improve this answer
1

Yes, what you describe is by definition a MITM attack and without having a spoofed certificate signed by a CA that is accepted by the client machines it will not be possible to have access to the TLS stream.

I strongly recommend the second way you propose and create a local facade. There you can have own "authoring" interface with multiple users for the same social media account without giving out the password and pre-check and approve posts.

Improve this answer
2
  • It is possible if you also have control of the client machine.
    – RubberDuck
    Apr 23, 2017 at 15:18
  • yes, as I said. If you control the client machine you can let them accept certificates from a CA that you control - and that issues the certificate you deliver from the MITM to make the client believe it is from the social network.
    – h0ru5
    Apr 23, 2017 at 17:52

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.