Monsters in the Middleboxes: Building Tools for Detecting HTTPS Interception

on YouTube ↗27m

" summary

An open-source Go library called Monster-in-the-Middle Engine fingerprints TLS client hellos and compares them to HTTP User-Agent strings to flag mismatches indicating interception, with support for JA3-style fingerprints and automated collection. Deployed over a 5% sample of Cloudflare traffic and surfaced in the public Malcolm dashboard, the method finds about 17% intercepted connections overall, with Android and Windows devices disproportionately affected and ongoing work to auto-refresh fingerprints.

AI-written summary · about

" chapters (7)

1. 0:00Introduction
2. 0:48Overview
3. 16:18Malcolm Dashboard
4. 17:09Traffic Analysis
5. 18:05Filtering
6. 18:46Conclusion
7. 19:46Questions

" related talks

• 43mPassive Fingerprinting of HTTP/2 Clients.Ory Segal · CODE BLUE 2017
• 58mCatching Transparent Phish: Understanding and Detecting MITM Phishing KitsNick Nikiforakis, Bria · OWASP 2022 Global AppSec Europe Virtual Event
• 46mHow to detect Malware in Encrypted Traffic Without DecryptionChristopher Van Der Made · NDC Security 2022
• 48mPassive Fingerprinting of HTTP/2 ClientsOry Segal, Elad Shuster · Black Hat Europe 2017
• 49mSecurity and Insecurity of HTTP HeadersDirk Wetter · OWASP AppSec Research (AppSecEU) 2015
• 52mWhere, how, and why is SSL traffic on mobile getting intercepted?Alban Diquet · OWASP AppSec California 2018
• 51mHow to Detect Malware in Encrypted Traffic WITHOUT DecryptionFlo Pachinger · Big Data Conference Europe 2022
• 44mNetsec is Dead(?): Modern Network Fingerprinting for...Vlad Iliushin · BSidesSF 2025