5 ms·
So do I understand this correctly - they intercepted the palace's web traffic and were somehow able to read it and inject malicious code? If so, how were they a
by martinko 10y ago
So do I understand this correctly - they intercepted the palace's web traffic and were somehow able to read it and inject malicious code? If so, how were they able to bypass ssl?
- kbart 10y agoThey used QUANTUM INSERT which is for HTTP not HTTPS. So they just needed to wait until someone accessed HTTP site. Here is more technical description on how QI works: https://blog.fox-it.com/2015/04/20/deep-dive-into-quantum-insert/ https://blog.fox-it.com/2015/04/20/deep-dive-into-quantum-in...
- labster 10y agoQUANTUM INSERT INTO box VALUES ('cat', 50%, 50%);
- eli 10y agoWhat percent of average web traffic was SSL in 2002?
- agd 10y agoThe hack is alleged to have taken place in 2012, not 2002.
- deleted 10y ago[deleted]
- dorfsmay 10y ago> Quantum Insert requires the NSA and GCHQ to have fast-acting servers relatively near a target’s machine that are capable of intercepting browser traffic swiftly in order to deliver a malicious web page to the target’s machine before the legitimate web page can arrive. It looks like they reply to a request instead of a legitimate server (poisoning DNS, or routing tables, maybe by jus adding a server to an anycast service) to infect the target machines. Once the target machine is infected, ssl, passwords, etc... No longer matter.
- baby 10y agoQuantum Insert doesn't reply "instead" of a legitimate server, rather it replies faster.
- comboy 10y agoI don't think that creating a fake cert is a problem for the NSA.
- rvschuilenburg 10y agoI think it's fair to assume the US Government has control over a root CA.
- mtgx 10y agoMaybe they got one of WoSign's certificates for the French government. Apparently it's quite easy to do that.
- 3pt14159 10y agoEither cert / dns shenanigans or a protocol downgrade attack.