6 ms·

How are downloads performed over http "potentially malicious"?

by huuuz 5y ago

kevingadd 5y ago
They can be MITM'd by anyone on a hop between you and the server, and unless they're an authenticode-signed exe they could also have been subtly tampered with at rest Mind you, HTTPS doesn't mean downloads are safe. Not remotely so. HTTP just means they're way less safe, and if you're on a HTTPS website it definitely should not be serving downloads over HTTP
CodesInChaos 5y ago
A MitM (e.g. an untrusted WiFi network) could replace a download by a malicious version.
- huuuz 5y ago
  In that case the html text of the page could be replaced by the attacker so the download link points to an https link.
  - MauranKilom 5y ago
    At least it can't be an HTTPS link to the same domain. But even if a user notices this, it's not worth a lot in the age of CDNs on weirdly abbreviated separate domains...
  - Semaphor 5y ago
    It’s for https sites that link http downloads.
  - peckrob 5y ago
    This absolutely can happen. A few years ago I discovered [0] Atlanta Airport's public WiFi was injecting ads into non-https pages. A malicious actor changing download links is not a far fetched possibility. [0] https://twitter.com/codelemur/status/1052285395575164929?s=20 https://twitter.com/codelemur/status/1052285395575164929?s=2...
  - falcolas 5y ago
    Firefox already aggressively alerts if you're not on an SSL secured page. They didn't for downloads.
CodesInChaos 5y ago
I wonder what "insecure connection" means. Does that include `http://localhost http://localhost`?
- wongarsu 5y ago
  I would expect the same rules as for secure contexts [1], namely "Locally-delivered resources such as those with http://127.0.0.1 http://127.0.0.1 URLs, http://localhost http://localhost and "http://*.localhost http://*.localhost URLs (e.g. http://dev.whatever.localhost/ http://dev.whatever.localhost/), and file:// URLs are also considered to have been delivered securely." 1: https://developer.mozilla.org/en-US/docs/Web/Security/Secure_Contexts https://developer.mozilla.org/en-US/docs/Web/Security/Secure...
noteboom 5y ago
Mozilla is foolish to buy into Google's bad faith attempt to create barriers to entry for small/old sites and further centralize the web.
- Spivak 5y ago
  Yeah how dare Mozilla force sites to pay for TLS certificates! It’s a racket I tell you! If they’re going to be required in order to be on the internet they should be free Mozilla: Okay, done.
  - noteboom 5y ago
    Time is money, I'm sure some users visiting websites that don't have the luxury of being maintained by multinational corporations will experience issues as a result of this change. TLS certificates are also not trivial to set up or renew if you require a wildcard certificate.
    - Spivak 5y ago
      Wildcard certificates are the much much easier case. You don't have to mess with your web server or routes at all. You just hook up certbot with your DNS provider and say "get me a cert for '*.mydomain.business", run the renew in a cronjob (which certbot does automatically by default now) and never touch it again. I've had certbot running for like 4 years with no interruption with this setup. The Venn Diagram of people who forgo managed hosting with SSL built-in and set up their own servers to host HTML pages on the internet and the people capable of following a guide to configure certbot is a circle.
      - noteboom 5y ago
        Not all DNS providers are supported by certbot, so sometimes it's impossible to automate. It's not infrequently that I come across sites with expired certificates nowadays. And what of those who have left their old site (that has no need for TLS) online for years without ever knowing 'insecure' HTTP is being deprecated? I don't think their sites breaking and showing warnings should be acceptable when the security benefits are so marginal.
darkhorn 5y ago
https://citizenlab.ca/2018/03/bad-traffic-sandvines-packetlogic-devices-deploy-government-spyware-turkey-syria/ https://citizenlab.ca/2018/03/bad-traffic-sandvines-packetlo... > Targeted users in Turkey and Syria who downloaded Windows applications from official vendor websites including Avast Antivirus, CCleaner, Opera, and 7-Zip were silently redirected to malicious versions by way of injected HTTP redirects. This redirection was possible because official websites for these programs, even though they might have supported HTTPS, directed users to non-HTTPS downloads by default.
Spivak 5y ago
The browser can’t know if the download was modified in flight and actually came from the server you requested it from.
HMH 5y ago
This would be massively annoying for my local network. I trust that I do not mitm myself for malicious reasons and really do not feel like setting up certs on my lan... Talking about certs, nowadays it seems browsers want to make you believe that self signed certs are some diabolical work straight from hell. Using self signed certs with websockets on Firefox is actually nearly impossible [1]. [1]: https://bugzilla.mozilla.org/show_bug.cgi?id=1187666 https://bugzilla.mozilla.org/show_bug.cgi?id=1187666
- literallyWTF 5y ago
  The push to demonize self-signed certs literally makes me think browsers are in the pocket of BigCert
  - jhomedall 5y ago
    Certificates from Let's Encrypt are free.
    - literallyWTF 5y ago
      Thanks man, but I don’t remember asking anything?
- asddubs 5y ago
  I do wish there was a way to disable all those https-only protections in a browser for development on the local machine. Yes I know for localhost they are sometimes disabled (but not always, like e.g. samesite=none cookies), but sometimes you want to test cross-domain interactions using a tool like dnsmasq, and it gets to be a real hassle

How are downloads performed over http "potentially malicious"?

by huuuz 5y ago

How are downloads performed over http "potentially malicious"?

They can be MITM'd by anyone on a hop between you and the server, and unless they're an authenticode-signed exe they could also have been subtly tampered with at rest Mind you, HTTPS doesn't mean downloads are safe. Not remotely so. HTTP just means they're way less safe, and if you're on a HTTPS website it definitely should not be serving downloads over HTTP

CodesInChaos 5y ago

A MitM (e.g. an untrusted WiFi network) could replace a download by a malicious version.

huuuz 5y ago
In that case the html text of the page could be replaced by the attacker so the download link points to an https link.
- MauranKilom 5y ago
  At least it can't be an HTTPS link to the same domain. But even if a user notices this, it's not worth a lot in the age of CDNs on weirdly abbreviated separate domains...
- Semaphor 5y ago
  It’s for https sites that link http downloads.
- peckrob 5y ago
  This absolutely can happen. A few years ago I discovered [0] Atlanta Airport's public WiFi was injecting ads into non-https pages. A malicious actor changing download links is not a far fetched possibility. [0] https://twitter.com/codelemur/status/1052285395575164929?s=20 https://twitter.com/codelemur/status/1052285395575164929?s=2...
- falcolas 5y ago
  Firefox already aggressively alerts if you're not on an SSL secured page. They didn't for downloads.

CodesInChaos 5y ago

I wonder what "insecure connection" means. Does that include `http://localhost http://localhost`?

wongarsu 5y ago
I would expect the same rules as for secure contexts [1], namely "Locally-delivered resources such as those with http://127.0.0.1 http://127.0.0.1 URLs, http://localhost http://localhost and "http://*.localhost http://*.localhost URLs (e.g. http://dev.whatever.localhost/ http://dev.whatever.localhost/), and file:// URLs are also considered to have been delivered securely." 1: https://developer.mozilla.org/en-US/docs/Web/Security/Secure_Contexts https://developer.mozilla.org/en-US/docs/Web/Security/Secure...

noteboom 5y ago

Mozilla is foolish to buy into Google's bad faith attempt to create barriers to entry for small/old sites and further centralize the web.

Spivak 5y ago
Yeah how dare Mozilla force sites to pay for TLS certificates! It’s a racket I tell you! If they’re going to be required in order to be on the internet they should be free Mozilla: Okay, done.
- noteboom 5y ago
  Time is money, I'm sure some users visiting websites that don't have the luxury of being maintained by multinational corporations will experience issues as a result of this change. TLS certificates are also not trivial to set up or renew if you require a wildcard certificate.
  - Spivak 5y ago
    Wildcard certificates are the much much easier case. You don't have to mess with your web server or routes at all. You just hook up certbot with your DNS provider and say "get me a cert for '*.mydomain.business", run the renew in a cronjob (which certbot does automatically by default now) and never touch it again. I've had certbot running for like 4 years with no interruption with this setup. The Venn Diagram of people who forgo managed hosting with SSL built-in and set up their own servers to host HTML pages on the internet and the people capable of following a guide to configure certbot is a circle.
    - noteboom 5y ago
      Not all DNS providers are supported by certbot, so sometimes it's impossible to automate. It's not infrequently that I come across sites with expired certificates nowadays. And what of those who have left their old site (that has no need for TLS) online for years without ever knowing 'insecure' HTTP is being deprecated? I don't think their sites breaking and showing warnings should be acceptable when the security benefits are so marginal.

darkhorn 5y ago

https://citizenlab.ca/2018/03/bad-traffic-sandvines-packetlogic-devices-deploy-government-spyware-turkey-syria/ https://citizenlab.ca/2018/03/bad-traffic-sandvines-packetlo... > Targeted users in Turkey and Syria who downloaded Windows applications from official vendor websites including Avast Antivirus, CCleaner, Opera, and 7-Zip were silently redirected to malicious versions by way of injected HTTP redirects. This redirection was possible because official websites for these programs, even though they might have supported HTTPS, directed users to non-HTTPS downloads by default.

Spivak 5y ago

The browser can’t know if the download was modified in flight and actually came from the server you requested it from.

HMH 5y ago

This would be massively annoying for my local network. I trust that I do not mitm myself for malicious reasons and really do not feel like setting up certs on my lan... Talking about certs, nowadays it seems browsers want to make you believe that self signed certs are some diabolical work straight from hell. Using self signed certs with websockets on Firefox is actually nearly impossible [1]. [1]: https://bugzilla.mozilla.org/show_bug.cgi?id=1187666 https://bugzilla.mozilla.org/show_bug.cgi?id=1187666

literallyWTF 5y ago
The push to demonize self-signed certs literally makes me think browsers are in the pocket of BigCert
- jhomedall 5y ago
  Certificates from Let's Encrypt are free.
  - literallyWTF 5y ago
    Thanks man, but I don’t remember asking anything?
asddubs 5y ago
I do wish there was a way to disable all those https-only protections in a browser for development on the local machine. Yes I know for localhost they are sometimes disabled (but not always, like e.g. samesite=none cookies), but sometimes you want to test cross-domain interactions using a tool like dnsmasq, and it gets to be a real hassle