4 ms·
There's nothing newsworthy here, just some guy trying to make a name for himself by giving his so called vulnerability a flashy name and website.
by mirashii 9y ago
There's nothing newsworthy here, just some guy trying to make a name for himself by giving his so called vulnerability a flashy name and website.
- mdeeks 9y agoNo, underneath the bad writing it appears there is a real problem here. If you go to his simple walkthrough page you get a better understanding: https://leakyx.com/info.php https://leakyx.com/info.php Credentials are sent BEFORE prompting the user to accept a self signed cert. So it sounds like an attacker can harvest credentials on a rogue wifi by spoofing DNS and using a self-signed cert. I don't have an iOS device so I can't test.
- mirashii 9y agoCan't edit to correct, but if what you say is true, I agree. Also no iOS device to test. It's really difficult to tell that's what's happening in the midst of all the incorrect statements and conclusions even up to that point, and with the B section being even more absurd. It's quite possible that the reporting to vendors would also miss the legitimate vulnerability through the rest of the noise.
- DiThi 9y agoThat link explains the problem much better than TFA.
- willstrafach 9y ago> Credentials are sent BEFORE prompting the user to accept a self signed cert. So it sounds like an attacker can harvest credentials on a rogue wifi by spoofing DNS and using a self-signed cert. I don't have an iOS device so I can't test. This does not appear to be the case (Tested on an iOS 10.3.3 device and an iOS 11 device).
- mdeeks 9y agoThanks for confirming. So then there is nothing at all of substance in this article.
- frlnBorg 9y agoWhy do you say this is not a vulnerability? For me, a layman, it seems like a vulnerability.
- mirashii 9y agoWhat about it seems like a vulnerability? At best, this is an avenue for a phishing hack for getting someone to put in a bad URL and then send their credentials. No different than registering and convincing someone go to go facebooksecurityservices.com and log in with their Facebook account.
- philjohn 9y agoAs someone else said, public wifi network, DNS hijack and boom, you've got their credentials.
- ricardobeat 9y agoSame as DNS hijacking any website where the user has an account. What's the security issue in Exchange here?
- ktta 9y agoDNS hijacking shouldn't result in credential compromise if TLS is implemented properly. TLS is implemented here, but incorrectly (hold on) because the credentials are sent as soon as the validation fails and a dialog shows up (about the invalid certificate). So the user will realize they are being MITMed but the credentials are sent even if they don't continue. https://news.ycombinator.com/item?id=15322740 https://news.ycombinator.com/item?id=15322740
- jlgaddis 9y agoNo certificate validation in "Test A".