3 ms·
The remediation points mentioned in the blog are interesting. "Make sure the app interacts with its designated server(s) via an encrypted protocol (e.g., HTTPS
by wallflower 13y ago
The remediation points mentioned in the blog are interesting.
"Make sure the app interacts with its designated server(s) via an encrypted protocol (e.g., HTTPS, instead of HTTP). As described earlier in the post, this is an effective mitigation for HRH, but not a fix."
but not a fix?
http://www.skycure.com/blog/http-request-hijacking/ http://www.skycure.com/blog/http-request-hijacking/
- bradleyland 13y agoYeah, that bugged the hell out of me as well. I'm not sure what the authors expect the iOS caching framework to do? It sounds like they would like to see a different default, so that if someone does execute an HRH, it expires. That seems silly though. IMO, a "fix" means not allowing the HRH to occur in the first place, and the means used to accomplish the HRH is the MITM attack. No MITM, no HRH.