3 ms·

> The main problem with keeping sites http is that someone in the middle can modify the content and inject arbitrary code I keep hearing this as a plausible ex

> The main problem with keeping sites http is that someone in the middle can modify the content and inject arbitrary code I keep hearing this as a plausible excuse, yet I've never seen any proof of such. non-https does make it possible but has anyone got any source where someone has been victim of such attacks?

snazz 6y ago
ISPs in the US have been doing it for years: https://www.infoworld.com/article/2925839/code-injection-new-low-isps.html https://www.infoworld.com/article/2925839/code-injection-new...
ozim 6y ago
First link, Kazakhstan even tried to MITM people with HTTPS, second injecting ads by ISP. [1]https://www.privateinternetaccess.com/blog/kazakhstan-tries-and-fails-to-mitm-all-of-its-internet-users-with-rogue-certificate-installation/ https://www.privateinternetaccess.com/blog/kazakhstan-tries-... [2]https://security.stackexchange.com/questions/157828/my-isp-bsnl-india-is-injecting-ads-using-phozeca-which-spoils-websites-and-mak https://security.stackexchange.com/questions/157828/my-isp-b...
- vbezhenar 6y ago
  Kazakhstan did not do that to inject ads. I believe that they wanted to block webpages on a granular level (for example some specific blogs). Right now they block complete websites, because it's not possible to find out which URL user is visiting.
  - jefftk 6y ago
    I read your parent as giving two separate examples.
cesarb 6y ago
> has anyone got any source where someone has been victim of such attacks? Yes, the most well-known victim was GitHub. A malicious MITM injected JavaScript code into an unrelated non-HTTPS page, making browsers which visited that page do a DDoS attack against GitHub. Quoting https://arstechnica.com/information-technology/2015/04/meet-great-cannon-the-man-in-the-middle-weapon-china-used-on-github/ https://arstechnica.com/information-technology/2015/04/meet-... "[...] The junk traffic came from computers of everyday people who browsed to websites that use analytics software from Chinese search engine Baidu to track visitor statistics. About one or two percent of the visits from people outside China had malicious code inserted into their traffic that caused their computers to repeatedly load the two targeted GitHub pages. [...]"
ajnin 6y ago
A cursory search returns many examples, for instance : https://www.privateinternetaccess.com/blog/comcast-still-uses-mitm-javascript-injection-serve-unwanted-ads-messages/ https://www.privateinternetaccess.com/blog/comcast-still-use...
ric2b 6y ago
I did it myself for fun while I was in high-school, it's quite a trivial thing actually. Just need to be on the same network as the victim and do some ARP spoofing to make your computer the gateway for that network.
jorl17 6y ago
Other have pointed it out, but ISPs (especially on mobile, at least in portugal) often do this. They add a little banner on the top to tell you some random bullshit about their data plan or some other such shit they want to sell you. As for attacks, others have pointed out examples as well, and I can assure you you can go far with them (and often with some simple social engineering). HTTP is just a no-no for me as a developer.

snazz 6y ago

ISPs in the US have been doing it for years: https://www.infoworld.com/article/2925839/code-injection-new-low-isps.html https://www.infoworld.com/article/2925839/code-injection-new...

ozim 6y ago

First link, Kazakhstan even tried to MITM people with HTTPS, second injecting ads by ISP. [1]https://www.privateinternetaccess.com/blog/kazakhstan-tries-and-fails-to-mitm-all-of-its-internet-users-with-rogue-certificate-installation/ https://www.privateinternetaccess.com/blog/kazakhstan-tries-... [2]https://security.stackexchange.com/questions/157828/my-isp-bsnl-india-is-injecting-ads-using-phozeca-which-spoils-websites-and-mak https://security.stackexchange.com/questions/157828/my-isp-b...

vbezhenar 6y ago
Kazakhstan did not do that to inject ads. I believe that they wanted to block webpages on a granular level (for example some specific blogs). Right now they block complete websites, because it's not possible to find out which URL user is visiting.
- jefftk 6y ago
  I read your parent as giving two separate examples.

cesarb 6y ago

> has anyone got any source where someone has been victim of such attacks? Yes, the most well-known victim was GitHub. A malicious MITM injected JavaScript code into an unrelated non-HTTPS page, making browsers which visited that page do a DDoS attack against GitHub. Quoting https://arstechnica.com/information-technology/2015/04/meet-great-cannon-the-man-in-the-middle-weapon-china-used-on-github/ https://arstechnica.com/information-technology/2015/04/meet-... "[...] The junk traffic came from computers of everyday people who browsed to websites that use analytics software from Chinese search engine Baidu to track visitor statistics. About one or two percent of the visits from people outside China had malicious code inserted into their traffic that caused their computers to repeatedly load the two targeted GitHub pages. [...]"

ajnin 6y ago

A cursory search returns many examples, for instance : https://www.privateinternetaccess.com/blog/comcast-still-uses-mitm-javascript-injection-serve-unwanted-ads-messages/ https://www.privateinternetaccess.com/blog/comcast-still-use...

ric2b 6y ago

I did it myself for fun while I was in high-school, it's quite a trivial thing actually. Just need to be on the same network as the victim and do some ARP spoofing to make your computer the gateway for that network.

jorl17 6y ago

Other have pointed it out, but ISPs (especially on mobile, at least in portugal) often do this. They add a little banner on the top to tell you some random bullshit about their data plan or some other such shit they want to sell you. As for attacks, others have pointed out examples as well, and I can assure you you can go far with them (and often with some simple social engineering). HTTP is just a no-no for me as a developer.