3 ms·

Is this Apple only? The articles do not mention Android.

by vaadu 13y ago

mike-cardwell 13y ago
I think it must be Android only because they don't mention Apple.
- mikenon 13y ago
  > On Tuesday, mobile security researchers will demonstrate a simple attack that exploits a vulnerability in the code within apps that run on Apple’s iOS operating system.
  - Piskvorrr 13y ago
    This vulnerability is pretty much OS-independent, and also ancient. Summary: "We have discovered that HTTP is insecure, also, we have discovered the 301 redirect; for this, we are expecting a nomination for the Nobel Prize, at the very least."
bradleyland 13y ago
It might be. This is a compound attack. The attack makes a couple of assumptions that are dangerous for both iOS and Android: 1) The app communication is using HTTP. 2) The attacker has some means of executing a MITM (man-in-the-middle) attack. The portion that appears to be unique to iOS (maybe it's not), is the default cache policy for 301 redirects. Specifically, once the attacker has targeted some HTTP traffic, they use the MITM attack to redirect iOS to the attacker's server instead of the intended one. The default cache policy on iOS makes this redirect more or less permanent. That's bad because once you leave the compromised network, your phone will continue to talk to the attacker's server instead of the intended one. The reason this exploit is seeing such an apathetic response is because the cache poisoning is pretty lame in comparison to having executed a MITM scenario. Once you have MITM, you have complete control over the traffic a device receives. For HTTP communications, this is not specific to iOS devices. The best mitigation for MITM attacks is to simply use HTTPS instead of HTTP. Unfortunately, it's not easy for iOS users to see whether an app is using secure back-end communications.
- uxp 13y ago
  The portion that appears to be unique to iOS (maybe it's not), is the default cache policy for 301 redirects. Its in the HTTP spec: > This response is cacheable unless indicated otherwise. - http://www.w3.org/Protocols/rfc2616/rfc2616-sec10.html#sec10.3.2 http://www.w3.org/Protocols/rfc2616/rfc2616-sec10.html#sec10... I'm fairly certain without doing any research whatsoever, that most every browser on most every platform is vulnerable to this attack. It is literally a DNS cache poisoning and MITM. Nothing more. The difference with a mobile platform is you're dealing with apps that don't have a URL bar to tell you that you've actually on qwerty.info/paypal instead of paypal.com, which is an indicator of an attack.

Is this Apple only? The articles do not mention Android.

by vaadu 13y ago

Is this Apple only? The articles do not mention Android.

mike-cardwell 13y ago

I think it must be Android only because they don't mention Apple.

mikenon 13y ago
> On Tuesday, mobile security researchers will demonstrate a simple attack that exploits a vulnerability in the code within apps that run on Apple’s iOS operating system.
- Piskvorrr 13y ago
  This vulnerability is pretty much OS-independent, and also ancient. Summary: "We have discovered that HTTP is insecure, also, we have discovered the 301 redirect; for this, we are expecting a nomination for the Nobel Prize, at the very least."

bradleyland 13y ago

It might be. This is a compound attack. The attack makes a couple of assumptions that are dangerous for both iOS and Android: 1) The app communication is using HTTP. 2) The attacker has some means of executing a MITM (man-in-the-middle) attack. The portion that appears to be unique to iOS (maybe it's not), is the default cache policy for 301 redirects. Specifically, once the attacker has targeted some HTTP traffic, they use the MITM attack to redirect iOS to the attacker's server instead of the intended one. The default cache policy on iOS makes this redirect more or less permanent. That's bad because once you leave the compromised network, your phone will continue to talk to the attacker's server instead of the intended one. The reason this exploit is seeing such an apathetic response is because the cache poisoning is pretty lame in comparison to having executed a MITM scenario. Once you have MITM, you have complete control over the traffic a device receives. For HTTP communications, this is not specific to iOS devices. The best mitigation for MITM attacks is to simply use HTTPS instead of HTTP. Unfortunately, it's not easy for iOS users to see whether an app is using secure back-end communications.

uxp 13y ago
The portion that appears to be unique to iOS (maybe it's not), is the default cache policy for 301 redirects. Its in the HTTP spec: > This response is cacheable unless indicated otherwise. - http://www.w3.org/Protocols/rfc2616/rfc2616-sec10.html#sec10.3.2 http://www.w3.org/Protocols/rfc2616/rfc2616-sec10.html#sec10... I'm fairly certain without doing any research whatsoever, that most every browser on most every platform is vulnerable to this attack. It is literally a DNS cache poisoning and MITM. Nothing more. The difference with a mobile platform is you're dealing with apps that don't have a URL bar to tell you that you've actually on qwerty.info/paypal instead of paypal.com, which is an indicator of an attack.