8 ms·
I don't see how this 'man' in the middle could actually intercept passwords, except for http, but who runs auth over http anyway. For https, the 'man' would ha
by adamconroy 8y ago
I don't see how this 'man' in the middle could actually intercept passwords, except for http, but who runs auth over http anyway. For https, the 'man' would have to substitute its own certificate and then the browser / client software wouldn't trust the cert/domain combination without the end user being extremely stupid (and knowledgeable enough to achieve the stupidity).
- krn 8y agoWhat about DNS spoofing[1] at the local network level? [1] https://en.wikipedia.org/wiki/DNS_spoofing https://en.wikipedia.org/wiki/DNS_spoofing
- p49k 8y agoThe spoofer wouldn’t be able to obtain a valid certificate for the spoofed site, though.
- swiftcoder 8y agoThe spoofer can obtain a valid certificate for another, seemingly legitimate site. Any software that hasn't explicitly pinned the leaf TLS certificates will still accept the (valid) certificate it is redirected to. And sadly, a lot of software still doesn't perform certificate pinning.
- tedunangst 8y agoHow is this redirect performed?
- deleted 8y ago[deleted]
- adamconroy 8y agoit might redirect to a malicious web page, but https would still prevent a problem. perhaps read the article you posted.
- stordoff 8y agoOnly if they are serving HTTPS or HTTPS is pinned. Otherwise, aren't you relying on the user noticing the lack of HTTPS (which I wouldn't want to do)?
- krn 8y agoThe user can just be redirected to another similar looking site with a valid TLS certificate.
- tedunangst 8y agoHow?
- ktta 8y agohttps://gmail.com.inbox-redirect.pro https://gmail.com.inbox-redirect.pro This will seem like a valid website, especially if the phishing site is done well. Not just non-technical users, I'd wager some tech familiar users would be fooled too. The focus always being on the lock icon might not always cover it. Safari will prevent this though.
- aaron_m04 8y agoIsn't that why browsers visually distinguish the TLD and the part before it from the rest of the URL?
- krn 8y agoSSL/TLS downgrade attack when HSTS is not enabled.
- jeffmcjunkin 8y agoIt could use something like bdfproxy[1] to intercept HTTP-downloaded EXE files, then add some persistent malware in _addition_ to whatever the EXE was doing. This has been done before, over Tor[2]. The malware doesn't have to add a new root certificate, either, though that's completely possible. The Zeus trojan [3] does "man-in-the-browser" to intercept banking information, for example. [1] https://github.com/secretsquirrel/BDFProxy https://github.com/secretsquirrel/BDFProxy [2] https://www.pcworld.com/article/2839152/tor-project-flags-russian-exit-node-server-for-delivering-malware.html https://www.pcworld.com/article/2839152/tor-project-flags-ru... [3] https://en.wikipedia.org/wiki/Zeus_(malware) https://en.wikipedia.org/wiki/Zeus_(malware)
- adamconroy 8y agoso the spoofer distributing these devices is going to all this trouble/expense/risk in the hope there is a http downloaded exe it can corrupt, then hopes the hashing doesn't fail on that corrupt exe, and hopes the user ignores the untrusted source warning so that it can install a trojan?
- Ajedi32 8y agoHow many users do you know of who manually check hashes on downloaded executables? And of course the user is going to ignore the untrusted source warning on an executable they intentionally downloaded and are trying to run.
- pluc 8y agoI think what he means is that it seems like a lot of trouble to hack someone who is not necessarily hackworthy? Like what kind of things would you expect to gain from someone who would be as computer illiterate as to allow all that to come to fruition?
- jeffmcjunkin 8y agoI agree that $25 / month is more than the average bot is generating. That said, there's a lot of value to many people's computers if properly exploited: https://krebsonsecurity.com/2012/10/the-scrap-value-of-a-hacked-pc-revisited/ https://krebsonsecurity.com/2012/10/the-scrap-value-of-a-hac...
- Ajedi32 8y agoSSL stripping perhaps? There are still plenty of sites that don't implement HSTS, and not all users are vigilant enough to notice when the site they're visiting suddenly doesn't have HTTPS anymore. Web security has been improving a lot in recent years, but it's not yet at the point where a man in the middle isn't a relevant threat.
- empath75 8y agoWhat are the odds that someone dumb enough to install this would be scared off by an insecure site warning?
- alangpierce 8y agoI think Chrome for a while has simply refused to let you visit a page when there's an SSL problem (at least for certain types of problems), which seems like a reasonable solution to the "people will just ignore warnings" problem.
- joeframbach 8y agoYou type in http://yourbank.com http://yourbank.com, your bank respomds with a 301 to https, but this helpful router instead takes you to its phishing site. Lots of people wouldn't notice.
- earenndil 8y agoOr it redirects you to https:// https:// yöurbank .com/, and you see the green padlock and think nothing more of it. Edit: made HN not mangle the link.
- mr_toad 8y agoI’d like to know which CA would issue an EV cert for a site like that - so I can remove them from my cert stores.
- Cthulhu_ 8y agoCA's are fully automated, they won't review or check for phishing lookalikes. Maybe reactively if it's being reported, but, should they operate as the internet police? What if it's a legitimate bank that has the same name (with an accent) and isn't beholden to the same trademark in their country?
- tialaramex 8y agoEV can't be (shouldn't be) fully automated, but: + It may seem like it is if your organisation gets a bunch of EV certs with the same organisation info under some bulk deal. The issuer only does the expensive manual EV steps once per period, if you're Google in January then (the thinking goes) you are still Google in June. This saves them money so it enables them to offer pretty good deals for lots of EV certs. + Good EV providers streamline the manual stuff in countries like the US that have their government records online. A call centre employee can do the searches, pull up contact details and phone your Head Office or whoever to confirm in minutes not hours. However this also means they won't necessarily pick up on subtle clues like why is this outfit named Myba N K ? Oh! That's My Bank but with misleading capitalisation and spacing. + White hats toying with EV discovered that outfits like D&B relied on in the business community to verify identity are... Not very reliable. If D&B says the Head Office is at 632 Wall Street that might be because somebody filled out a web form, not because D&B agents even checked 632 Wall Street exists let alone that the company has offices there...
- ttty 8y agohttps://news.ycombinator.com/item?id=18090419 https://news.ycombinator.com/item?id=18090419