4 ms·
If your browser can be hijacked by visiting a webpage, the threat vector is not substantially different whether the website is HTTPS or not. It changes the atta
by shalmanese 6y ago
If your browser can be hijacked by visiting a webpage, the threat vector is not substantially different whether the website is HTTPS or not. It changes the attack path from a MITM attack to a watering hole attack but that doesn't overly raise the difficulty level.
The real threat in this case was that sending the right string of data to a browser let a malicious actor execute a RCE and install malware. Either you trust the browser to be secure against such attacks or you can't trust much of anything.
- snark42 6y agoIf I'm targeting an individual/organization a watering hole attack requires that I can own a site the target visits regularly. This seems a lot more complicated than just going to any unencrypted website via network redirection of some sort. Do most people routinely visit encrypted sites that are easily hacked to target an RCE on an individual?
- PlasticTank 6y agoYou don't need to compromise a site they visit regularly, there are plenty of other ways to get someone to visit a malicious page, phishing email or even a link on HackerNews for example. People will visit new sites for all kinds of reasons, you'd just need to understand your target.
- bigiain 6y agoAlso, I at least, have very little confidence that a state level actor couldn't subvert the news.ycombinator.com hosting provider if it wanted to seriously enough. If someone were to be "secure enough" to be running drugs/guns/children - they'd _have_ to be totally disconnected from the internet and cellular networks, and probably all their first and second level associates as well. I don't have any sympathy for those people, but sadly a journalist critical of a government has all the same problems there, and that's bad for humanity.
- jimmydorry 6y agoWhile I'm not certain about the terminology and whether this would still be a watering hole attack, but any of the "Show HN" posts here, could trivially be hosted by an actor with malicious intentions.