3 ms·
This is not a good counterexample: the attacker is only able to do this because the analytics scripts are being served over HTTP. If you include the analytics
by jefftk 7y ago
This is not a good counterexample: the attacker is only able to do this because the analytics scripts are being served over HTTP. If you include the analytics on your site over HTTPS this sort of attack is not relevant.
- ninkendo 7y agoI imagine China has quite a bit of infrastructure to push their own CA's onto devices in china, enough to do any MITM'ing they want.
- mminer237 7y agoThe Chinese government has the root certificates for every Chinese certificate authority. It can MITM traffic for any citizen, even over HTTPS.
- jefftk 7y agoWhat makes this attack powerful is not that sites within China can be shut down (the government can already do that) but that sites outside of China can be tricked into DDOSing other sites outside of China. Which is why this attack only works over HTTP.
- saagarjha 7y agoRight, but the traffic is coming from users in China is past the point that HTTPS would help. The requests are already in flight from people in China who've been served malicious JavaScript.
- mminer237 7y agoWhat I mean is that China can just force a CA to give the CPC its root certificate and then just intercept and edit any HTTPS responses to Chinese citizens and resign them as secure.
- inimino 7y agoIt would work just as well over HTTPS, they would just have to make a different phone call (to the site hosting the script rather than to the GFW).
- pavel_lishin 7y agoFor _this_ particular example, yes. But ad networks aren't magically immune from other types of attacks.