5 ms·
The code injected to steal passwords in Tunisia
- marshray 16y agoIsn't it time for Godaddy to take the password box off their unencrypted home page now?
- mrkurt 16y agoThis is why mixed content warnings from browsers are an oh-so-important annoyance.
- maukdaddy 16y agoAlso why the entire login page needs to be served via SSL.
- nodata 16y agoand surely the entire site, if you want to avoid session hijacking. (and after that, all the government needs to do is require an ssl signing authority to be used by all tunisian banks, and it's back in!)
- blinkingled 16y agoThere is no such thing as Security - only the illusion, that too of Selective, Government Controlled Security :)
- mustpax 16y agoNo mixed content warnings here though. The ISP is editing the login page to include JavaScript that posts the password back, seemingly, to Facebook at http://www.facebook.com/wo0dh3ad http://www.facebook.com/wo0dh3ad. Being a man in the middle, the ISP can capture all requests to this non existent URL and harvest the passwords. The browser can't suspect a thing.
- smackfu 16y agoAlso why real companies need to be much better about not ignoring them on poorly written https pages that refer to http assets.
- anonymous246 16y ago"... was stealing usernames and passwords from common sites like Google Mail and Facebook". Gmail always opens with SSL for me. Didn't Google make this the default after Chinagate?
- jawher 16y agoNope, at the time of these incidents, I could request GMail's login page over HTTP, though the login form action pointed to a HTTPS url. This was fixed a day or two later though. Same with Yahoo.
- gcb 16y agoIf you're the ISP, can't you fake ssl certs all the way down to the root? sorry if i'm being ignorant
- die_sekte 16y agoSSL certificates usually come with the OS or the browser. AFAIK there's no easy way for the ISP to add certificates.
- barmstrong 16y agoI might have missed this, but how was the javascript injected in the first place? Did they have a URL param being displayed (unescaped) on the page?
- adn37 16y agoAttacker sits at network / ISP level, and can therefore inject any (js, ...) payload in non-https web pages, on the fly.
- jawher 16y agoNope, nothing of the sort. The government has absolute control over the internet infrastructure here, and they manipulated the page's markup on the fly (or maybe the served an already modified and cached copy) when requested.
- mustpax 16y agoUnfortunately just encrypting the login page would not protect user accounts from Tunisia's ISP. The ISP can just sniff your session cookie and hijack your session instead. They won't be able to change your password but they can read and write all your other data. The only real protection here is to go full SSL and not forget to set the SSL only flag on session cookies. Even then, you only have to wait till Tunisia buys a forged certificate for Facebook.
- eli 16y agoOr they just redirect all HTTPS requests back to HTTP. How many people would notice?
- marshray 16y agoPresumably a Tunisan blogger may be "paranoid" enough to notice. When it's your your password on the line (and possibly your ass in jail) data security is more than aggregate statistics.
- eli 16y agoErr, well, I'm pretty sure they could have logged in via HTTPS all along by just manually typing in http://www.facebook.com http://www.facebook.com
- marshray 16y agoIf the URL starts with "http:", the attacker gets to decide which parts (if any) are going to be sent HTTPS.
- eli 16y agoSorry, either either the autolinker or I screwed up that post. My point was that if people cared about security, they could have been visting the facebook login page by manually typing HTTPS in the first place.
- tmachinecharmer 16y agoIt is very easy to get someones password if they have checked "remember me" and gone out for a coffee. By very easy I mean it requires almost no talent. Long time back (even)I wrote a script to grab password and username using DOM and JavaScript.
- MichaelGG 16y agoIf you mean using the browser or OS password mechanism, then sure, if you're logged in as the user you can access their secrets. But this doesn't should not be true for "remember me" cookies. Those just need some identifier. At any rate, you still need "talent": to know where the person is, when they're going for coffee, ability to access their machine without bystanders asking questions, etc.
- marshray 16y agoIf you control any firewall or router along the way you can inject iframes which retrieve any url you like and run script in the same-origin context. Except for "https only" sites, but note that Microsoft helpfully provides the government of Tunisia with a trusted root CA in their products. Try https://www.certification.tn/ https://www.certification.tn/ . I wonder if it's a code-signing cert?
- marshray 16y agoYes, it's a code signing cert. If you have access to a Windows machine, visit http://bit.ly/eWYRbA http://bit.ly/eWYRbA in IE then check your personal cert store for Agence Nationale de Certification Electronique
- ZoFreX 16y ago> Microsoft helpfully provides the government of Tunisia with a trusted root CA in their products Isn't this rather huge news? Why did they do this sort of downgrading hackery when they could do a more elegant (and slightly more transparent) man in the middle?
- thisisblurry 16y agoSimilar HN post (2.5 weeks ago): http://news.ycombinator.com/item?id=2079223 http://news.ycombinator.com/item?id=2079223
- jessedhillon 16y agoI don't see how Javascript is to blame here, which is I think what the author is implying with the "game over" link to slides about JS insecurity. This attack only worked because the attacker could subvert the same-domain origin policy, by posting usernames and passwords to a page at the facebook.com domain (but which was routed to an attacker's host at a lower level.) The security failure happened at a lower layer than where Javascript security would be responsible.