5 ms·

The main problem with keeping sites http is that someone in the middle can modify the content and inject arbitrary code, be it ads, crypto mining or just a redi

by jorl17 6y ago

The main problem with keeping sites http is that someone in the middle can modify the content and inject arbitrary code, be it ads, crypto mining or just a redirect to a worse website. Therefore I believe it should be a social duty to make everything https so as to ensure that we don’t create something that can be used to harm others. I didn’t use to think like this until I actually tried it out by going to a mall and doing it myself. Whoever was accessing simple http websites for the very short end of a stick (metaphorically speaking)

cat199 6y ago
there is a middle ground of authenticating traffic without encrypting it - c.f. IPSEC AH mode - granted this type of thing isn't in HTTP but easily could be
- ric2b 6y ago
  What would be the advantage of that? Saving a few CPU cycles, maybe?
doublerabbit 6y ago
> The main problem with keeping sites http is that someone in the middle can modify the content and inject arbitrary code I keep hearing this as a plausible excuse, yet I've never seen any proof of such. non-https does make it possible but has anyone got any source where someone has been victim of such attacks?
- snazz 6y ago
  ISPs in the US have been doing it for years: https://www.infoworld.com/article/2925839/code-injection-new-low-isps.html https://www.infoworld.com/article/2925839/code-injection-new...
- ozim 6y ago
  First link, Kazakhstan even tried to MITM people with HTTPS, second injecting ads by ISP. [1]https://www.privateinternetaccess.com/blog/kazakhstan-tries-and-fails-to-mitm-all-of-its-internet-users-with-rogue-certificate-installation/ https://www.privateinternetaccess.com/blog/kazakhstan-tries-... [2]https://security.stackexchange.com/questions/157828/my-isp-bsnl-india-is-injecting-ads-using-phozeca-which-spoils-websites-and-mak https://security.stackexchange.com/questions/157828/my-isp-b...
  - vbezhenar 6y ago
    Kazakhstan did not do that to inject ads. I believe that they wanted to block webpages on a granular level (for example some specific blogs). Right now they block complete websites, because it's not possible to find out which URL user is visiting.
    - jefftk 6y ago
      I read your parent as giving two separate examples.
- cesarb 6y ago
  > has anyone got any source where someone has been victim of such attacks? Yes, the most well-known victim was GitHub. A malicious MITM injected JavaScript code into an unrelated non-HTTPS page, making browsers which visited that page do a DDoS attack against GitHub. Quoting https://arstechnica.com/information-technology/2015/04/meet-great-cannon-the-man-in-the-middle-weapon-china-used-on-github/ https://arstechnica.com/information-technology/2015/04/meet-... "[...] The junk traffic came from computers of everyday people who browsed to websites that use analytics software from Chinese search engine Baidu to track visitor statistics. About one or two percent of the visits from people outside China had malicious code inserted into their traffic that caused their computers to repeatedly load the two targeted GitHub pages. [...]"
- ajnin 6y ago
  A cursory search returns many examples, for instance : https://www.privateinternetaccess.com/blog/comcast-still-uses-mitm-javascript-injection-serve-unwanted-ads-messages/ https://www.privateinternetaccess.com/blog/comcast-still-use...
- ric2b 6y ago
  I did it myself for fun while I was in high-school, it's quite a trivial thing actually. Just need to be on the same network as the victim and do some ARP spoofing to make your computer the gateway for that network.
- jorl17 6y ago
  Other have pointed it out, but ISPs (especially on mobile, at least in portugal) often do this. They add a little banner on the top to tell you some random bullshit about their data plan or some other such shit they want to sell you. As for attacks, others have pointed out examples as well, and I can assure you you can go far with them (and often with some simple social engineering). HTTP is just a no-no for me as a developer.
gambler 6y ago
Funny how "security experts" here complain about accidental non-repudiation misfeature of DKIM, but apparently being forced to do a bunch of crazy crap HTTPS forces you to do when all you need is content signature verification is perfectly fine with those same people. Security is becoming a field dominated by some bizarre corporate ideology.
- deleted 6y ago
  [deleted]
- simias 6y ago
  I don't understand your point, content signature verification would have the same consequences that HTTPS for non-repudiation, no? Also it's really different from DKIM: the problem with DKIM is that since the signature is part of the email itself, so unless the receiver bothers to strip it (why would they?) then it's stored forever in the metadata, even though arguably its use as an anti-spam feature stops being relevant once it's been delivered to the MUA. So basically every time you send an email through gmail you effectively also send a signature saying "I, Google, vouch that h4x0r@gmail.com did send this email" and the receiving end will keep this signature for as long as they keep the email. HTTPS session keys however are not typically saved unless somebody goes out of their way to do it. As such it's a lot less likely to be used for blackmail in hindsight. In general people use archive.org to prove that some content used to exist in this scenario, not old HTTPS session dumps. And like for DKIM the solution is fairly trivial if it's really an issue: every time you rotate your keys (which should be fairly frequent if you use something like letsencrypt) be sure to make the expired private keys available publicly to give you plausible deniability. I have yet to hear a good argument against HTTPS everywhere honestly, it generally boils down to "but I don't want to do it" with some weak post-hoc justification for why it's bad.
- snazz 6y ago
  What "crazy crap" are you talking about? I get that HTTPS might be overkill for some situations, but it's not difficult to use and every client device supports it. If you came up with your own signature-but-no-encryption protocol (maybe something similar to DKIM, actually?), nobody would support it. Even if they did, I'm sure that some people would use it when HTTPS is a better solution, just because they don't understand the tradeoffs. A standardized overkill solution that covers most use cases is probably better than n+1 standards with different tradeoffs.
userbinator 6y ago
Therefore I believe it should be a social duty to make everything https so as to ensure that we don’t create something that can be used to harm others. Those who give up freedom for security deserve neither.
- josephcsible 6y ago
  Nobody's saying you should be required by law to use HTTPS. Voting is a social duty too and it's not mandatory.
  - wildfire 6y ago
    The world would be a better place if voting was mandatory ( like it is in Australia ).
    - shadowgovt 6y ago
      Agree to disagree. I've met enough Americans to believe that if we made voting mandatory, we'd just end up with Optimus Prime at the top of the ticket. You can make an act compulsory on the whole population but you can't legislate duty-of-care upon the whole population.
      - kibwen 6y ago
        Voting should be mandatory but the first listed option for every office should be "I approve of no candidate and think none of them should win" (the disaffected vote), and the second listed option should be "I approve of every candidate and don't care who wins" (the apathetic vote). With our current system it's impossible to tease out how many voters are disaffected vs apathetic vs simply disenfranchised (in the above scheme, those who don't make it to the polls at all), which makes it impossible to confirm or deny that any candidate has the mandate of the people.
        a1369209993 6y ago
        Technically those options are trivial with a non-defective system like approval voting, but assuming you're stuck with first-past-the-post, that's pretty much correct.
stonecharioteer 6y ago
I've seen this said in several spots and I am curious. Could you point me to a resource that teaches me how to do this with a HTTP website please? I have no experience in doing this and am very interested to learn. Thanks in advance!
- aeturnum 6y ago
  The answer to your question will depend on the set of technologies that you are using, but a great place to start is the EFF's Certbot[1]. Certbot will, for many common web servers, verify your servers' domain address and install a cert that will work for ~3 months. It's free and mostly automated. I've been getting certs for all of my side projects and it takes about ~10 minutes each. Highly recommend. [1] https://certbot.eff.org/ https://certbot.eff.org/
  - stonecharioteer 6y ago
    Oh wait I didn't out across what I wanted. I meant how do I do a simple "attack" on a http website that's at a mall as OP said. I know how to use certbot for the certificates, (thank you Digital Ocean docs). I was wondering. If I run a simple http page on my home network, how can I, from another device, change it or make another client get a modified page with the same address?
    - shawnz 6y ago
      I think they are referring to ARP cache poisoning. Or maybe Wi-Fi promiscuous mode packet sniffing, but that's a read-only attack.
Sodman 6y ago
I would love to see a version of www.paulgraham.com covered in FB ads for jobs at megacorps...

by jorl17 6y ago

cat199 6y ago

there is a middle ground of authenticating traffic without encrypting it - c.f. IPSEC AH mode - granted this type of thing isn't in HTTP but easily could be

ric2b 6y ago
What would be the advantage of that? Saving a few CPU cycles, maybe?

doublerabbit 6y ago

> The main problem with keeping sites http is that someone in the middle can modify the content and inject arbitrary code I keep hearing this as a plausible excuse, yet I've never seen any proof of such. non-https does make it possible but has anyone got any source where someone has been victim of such attacks?

snazz 6y ago
ISPs in the US have been doing it for years: https://www.infoworld.com/article/2925839/code-injection-new-low-isps.html https://www.infoworld.com/article/2925839/code-injection-new...
ozim 6y ago
First link, Kazakhstan even tried to MITM people with HTTPS, second injecting ads by ISP. [1]https://www.privateinternetaccess.com/blog/kazakhstan-tries-and-fails-to-mitm-all-of-its-internet-users-with-rogue-certificate-installation/ https://www.privateinternetaccess.com/blog/kazakhstan-tries-... [2]https://security.stackexchange.com/questions/157828/my-isp-bsnl-india-is-injecting-ads-using-phozeca-which-spoils-websites-and-mak https://security.stackexchange.com/questions/157828/my-isp-b...
- vbezhenar 6y ago
  Kazakhstan did not do that to inject ads. I believe that they wanted to block webpages on a granular level (for example some specific blogs). Right now they block complete websites, because it's not possible to find out which URL user is visiting.
  - jefftk 6y ago
    I read your parent as giving two separate examples.
cesarb 6y ago
> has anyone got any source where someone has been victim of such attacks? Yes, the most well-known victim was GitHub. A malicious MITM injected JavaScript code into an unrelated non-HTTPS page, making browsers which visited that page do a DDoS attack against GitHub. Quoting https://arstechnica.com/information-technology/2015/04/meet-great-cannon-the-man-in-the-middle-weapon-china-used-on-github/ https://arstechnica.com/information-technology/2015/04/meet-... "[...] The junk traffic came from computers of everyday people who browsed to websites that use analytics software from Chinese search engine Baidu to track visitor statistics. About one or two percent of the visits from people outside China had malicious code inserted into their traffic that caused their computers to repeatedly load the two targeted GitHub pages. [...]"
ajnin 6y ago
A cursory search returns many examples, for instance : https://www.privateinternetaccess.com/blog/comcast-still-uses-mitm-javascript-injection-serve-unwanted-ads-messages/ https://www.privateinternetaccess.com/blog/comcast-still-use...
ric2b 6y ago
I did it myself for fun while I was in high-school, it's quite a trivial thing actually. Just need to be on the same network as the victim and do some ARP spoofing to make your computer the gateway for that network.
jorl17 6y ago
Other have pointed it out, but ISPs (especially on mobile, at least in portugal) often do this. They add a little banner on the top to tell you some random bullshit about their data plan or some other such shit they want to sell you. As for attacks, others have pointed out examples as well, and I can assure you you can go far with them (and often with some simple social engineering). HTTP is just a no-no for me as a developer.

gambler 6y ago

Funny how "security experts" here complain about accidental non-repudiation misfeature of DKIM, but apparently being forced to do a bunch of crazy crap HTTPS forces you to do when all you need is content signature verification is perfectly fine with those same people. Security is becoming a field dominated by some bizarre corporate ideology.

deleted 6y ago
[deleted]
simias 6y ago
I don't understand your point, content signature verification would have the same consequences that HTTPS for non-repudiation, no? Also it's really different from DKIM: the problem with DKIM is that since the signature is part of the email itself, so unless the receiver bothers to strip it (why would they?) then it's stored forever in the metadata, even though arguably its use as an anti-spam feature stops being relevant once it's been delivered to the MUA. So basically every time you send an email through gmail you effectively also send a signature saying "I, Google, vouch that h4x0r@gmail.com did send this email" and the receiving end will keep this signature for as long as they keep the email. HTTPS session keys however are not typically saved unless somebody goes out of their way to do it. As such it's a lot less likely to be used for blackmail in hindsight. In general people use archive.org to prove that some content used to exist in this scenario, not old HTTPS session dumps. And like for DKIM the solution is fairly trivial if it's really an issue: every time you rotate your keys (which should be fairly frequent if you use something like letsencrypt) be sure to make the expired private keys available publicly to give you plausible deniability. I have yet to hear a good argument against HTTPS everywhere honestly, it generally boils down to "but I don't want to do it" with some weak post-hoc justification for why it's bad.
snazz 6y ago
What "crazy crap" are you talking about? I get that HTTPS might be overkill for some situations, but it's not difficult to use and every client device supports it. If you came up with your own signature-but-no-encryption protocol (maybe something similar to DKIM, actually?), nobody would support it. Even if they did, I'm sure that some people would use it when HTTPS is a better solution, just because they don't understand the tradeoffs. A standardized overkill solution that covers most use cases is probably better than n+1 standards with different tradeoffs.

userbinator 6y ago

Therefore I believe it should be a social duty to make everything https so as to ensure that we don’t create something that can be used to harm others. Those who give up freedom for security deserve neither.

josephcsible 6y ago
Nobody's saying you should be required by law to use HTTPS. Voting is a social duty too and it's not mandatory.
- wildfire 6y ago
  The world would be a better place if voting was mandatory ( like it is in Australia ).
  - shadowgovt 6y ago
    Agree to disagree. I've met enough Americans to believe that if we made voting mandatory, we'd just end up with Optimus Prime at the top of the ticket. You can make an act compulsory on the whole population but you can't legislate duty-of-care upon the whole population.
    - kibwen 6y ago
      Voting should be mandatory but the first listed option for every office should be "I approve of no candidate and think none of them should win" (the disaffected vote), and the second listed option should be "I approve of every candidate and don't care who wins" (the apathetic vote). With our current system it's impossible to tease out how many voters are disaffected vs apathetic vs simply disenfranchised (in the above scheme, those who don't make it to the polls at all), which makes it impossible to confirm or deny that any candidate has the mandate of the people.
      - a1369209993 6y ago
        Technically those options are trivial with a non-defective system like approval voting, but assuming you're stuck with first-past-the-post, that's pretty much correct.

stonecharioteer 6y ago

I've seen this said in several spots and I am curious. Could you point me to a resource that teaches me how to do this with a HTTP website please? I have no experience in doing this and am very interested to learn. Thanks in advance!

aeturnum 6y ago
The answer to your question will depend on the set of technologies that you are using, but a great place to start is the EFF's Certbot[1]. Certbot will, for many common web servers, verify your servers' domain address and install a cert that will work for ~3 months. It's free and mostly automated. I've been getting certs for all of my side projects and it takes about ~10 minutes each. Highly recommend. [1] https://certbot.eff.org/ https://certbot.eff.org/
- stonecharioteer 6y ago
  Oh wait I didn't out across what I wanted. I meant how do I do a simple "attack" on a http website that's at a mall as OP said. I know how to use certbot for the certificates, (thank you Digital Ocean docs). I was wondering. If I run a simple http page on my home network, how can I, from another device, change it or make another client get a modified page with the same address?
  - shawnz 6y ago
    I think they are referring to ARP cache poisoning. Or maybe Wi-Fi promiscuous mode packet sniffing, but that's a read-only attack.

Sodman 6y ago

I would love to see a version of www.paulgraham.com covered in FB ads for jobs at megacorps...