This forum thread needs a solution.
Kudos0

What is an "SSL Decrypting" compromised network?

Posted: 19-Aug-2022 | 4:58AM · 7 Replies ·

My phone yesterday warned me that my WiFi network is compromised, due to an "Attack type: SSL Decrypting" I can't find any info on what this kind of attack is, or how to resolve the issue. This is my network being flagged so disconnecting and finding another isn't an option, I need to know what's wrong with the network and how to fix it.
Labels: Android, Activity Log, Wi-Fi Security, Alerts/Notifications

Replies

Kudos0

Re: What is an "SSL Decrypting" compromised network?

Posted: 19-Aug-2022 | 7:27AM · Permalink

What device and OS version are you using?

Try power cycling your modem and router, and restart your device to see if that fixes the issue. Searching on this issue shows a similar problem cropped up in 2018 and required an update from Norton. 

Kudos0

Re: What is an "SSL Decrypting" compromised network?

Posted: 19-Aug-2022 | 8:09AM · Permalink

It's a Pixel 6 running Android 13. I've power cycled, and changed SSIDs/passwords.. I saw that it was a red herring back in 2018, but I guess I just want to know what it is _supposed_ to be checking for so I can verify it is now fixed independently. The support doc here: https://support.norton.com/sp/en/us/norton-360-premium/22.22.7.14/soluti... Just reads like a list of fancy phrases without any detail at all, and their instructions (which were to use their VPN) has no info on what the bad behavior actually was. I assume it's some kind of SSL interception, but if so which sites were being intercepted and what was the middle man?
Kudos0

Re: What is an "SSL Decrypting" compromised network?

Posted: 19-Aug-2022 | 1:45PM · Permalink

Did this detection start after you upgraded to Android 13? 

Kudos0

Re: What is an "SSL Decrypting" compromised network?

Posted: 20-Aug-2022 | 6:48AM · Permalink

Yeah, about 48 hours later. But the same time as a relative connected a laptop without any anti virus to my network, hence why I'm not treating this as a red herring.

Even if it is a red herring, my question still stands, what is Norton checking for when it scans for "SSL Decrypting"?

Kudos0

Re: What is an "SSL Decrypting" compromised network?

Posted: 30-Aug-2022 | 8:43AM · Permalink

Sorry for late reply. 

As it coincided with the OS upgrade, I would suspect that first. Your relative connecting to your network is unlikely to have changed anything in your network, or you would see the warning on all devices protected by Norton.

I would suggest posting on the manufacturer's Support site to see if others are seeing anything similar.

In the mean time, have a look through all the network settings you can find on the device to see if there is anything that looks like it might intercept your data for any scans or control.

Kudos0

Re: What is an "SSL Decrypting" compromised network?

Posted: 30-Aug-2022 | 9:59AM · Permalink

It actually started happening on an iPhone as well...

We think we've traced it to a Netgear Wifi Extender - this works on an identical SSID but in the case where you're dropping in and out of the repeater vs the actual router vs your mobile network, things SSL wise seem to go a bit weird.

Would still love to know what Norton is actually scanning for. That there's no detail on this makes me feel like Norton is just pumping up a bunch of words on screen to make you feel comforted that it is "doing something".

I see that this has come up in another thread btw:

https://community.norton.com/en/forums/compromised-network-or-not

Kudos0

Re: What is an "SSL Decrypting" compromised network?

Posted: 30-Aug-2022 | 10:15AM · Permalink

Without the poster in that thread replying to my questions, it is hard to say that the two are the same. They may be related as they are reporting some issue with the network. 

Here is another thread with a compromised network warning that turned out to be related to a security feature of their router.  https://community.norton.com/en/forums/n360-compromised-network-mitm-arp...

As for exactly what Norton is looking/scanning for, it may be proprietary information so that the bad guys cannot use the information to try to get around Norton. So not sure you could ever get that information.

This thread is closed from further comment. Please visit the forum to start a new thread.