4 ms·
>What does https have to do with getting exploited? It significantly helps to prevent MITM [1] (Man-in-the-middle) attacks. (without scary certificate warnings
by iotku 6y ago
>What does https have to do with getting exploited?
It significantly helps to prevent MITM [1] (Man-in-the-middle) attacks. (without scary certificate warnings anyways)
>If the web server is compromised, then it’ll inject the malicious JavaScript code into the HTML, and transmit that to you. SSL is irrelevant in this regards.
The web server isn't compromised in this case, presumably the network is compromised.
>Unless when not using SSL, then the HTML is getting intercepted in flight, and a malicious JavaScript code is injected into the HTML.
Yes.
>Is that more of what we are now seeing these days? The routers are compromised, and the HTML is getting compromised too.
"Stingray" devices [2] spoof mobile towers so cellphones are tricked into believing they're connecting to "Just another cell phone tower" and at that point traffic can be captured/modified.
>Granted, I’m fully in support of SSL. Nobody should be seeing what you are browsing.
It's more than people just knowing what you're browsing (or issues such as leaking passwords/private info), it's that if someone can MITM you, they can also transparently modify unencrypted data (including adding exploits).
1. https://en.wikipedia.org/wiki/Man-in-the-middle_attack https://en.wikipedia.org/wiki/Man-in-the-middle_attack
2. https://en.wikipedia.org/wiki/Stingray_phone_tracker https://en.wikipedia.org/wiki/Stingray_phone_tracker
- blackrock 6y agoNice reply. Thanks. I suspected MITM is now technically feasible. Although I wasn’t quite sure how widespread it was. The stingray is indeed worrying. And it’s been around for nearly 20 years now. So everyone with a cell phone, or using WiFi over a cellular hotspot, can now get caught up in a MITM exploitation attack, if they browse a non-https website. When will the network providers now issue a blanket ban on browsing over plain http?
- nuker 6y ago> and at that point traffic can be captured/modified. Always on VPN on the phone beats this, imho.
- blackrock 6y agoSo, even with a VPN, you are still going through the Stingray. But you can establish a point-to-point secured connection tunnel with the VPN. Then the VPN goes to the non-SSL website, and gets the html in plain text. But, if there are compromised routers between the VPN and the website, then you can still be MITM attacked. Hmm.. a determined foe can still checkmate you, for visiting a non-SSL website, even over VPN.
- boring_twenties 6y agoThe adversary in this case is the local (Moroccan) government, so using a VPN would have likely saved him, as long as he chose one with an exit in a different country (one unlikely to cooperate with his own, obviously). If the insecure website itself is in Morocco then he's hosed either way, whether the website is behind SSL or not.