Re: [White Paper] The easiest way to get around SSL

--EE8jvUPYYQjJtG7J
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
Content-Transfer-Encoding: quoted-printable



> A good test was listed in the paper later on, by changing the HTTPS://=20
> to HTTP:// to see if you get the same data returned. Most sites offer=20
> SSL as a way to keep private information safe in transit, but must keep=
=20
> the normal transit methods around because some browsers do not support=20
> higher level ciphers and/or bits (i.e. 128bit or higher). Also, other=20
> countries, especially those on the US black lists cannot do SSL (at=20
> least in a meaningful manner). So a lot of sites test positive this test=
=20
> unfortunately (which is bad) but have to because of no other means is=20
> available.

Let's assume that the server does require an HTTPS connection for it's
secure stuff.  The method described in the paper would fail, because
the server should reject the incoming non-SSLified connection from
the attacker.

However, there's no reason the attacker couldn't speak HTTPS to
the server.  The server would see a nice happy HTTPS connection,
never knowing that the victim is only being provided HTTP.

Hmmn - what if the server tries to prevent this sort of attack,
perhaps doing some sort of java script to make sure the URL has
https in it?  Oh, in that case we can have the attacker support
HTTPS MITM to the client and not rewrite any of the URLs at all.
Sure, it'll pop up a warning, but everyone clicks 'ok' on those
anyway.


And, at this point we have now re-created dsniff.  Well, that
was worthwhile.




--
Brian Hatch                  "If you play the WindowsXP CD
   Systems and                backwards, you get a Satanic message."
   Security Engineer         "That's nothing.  If you play it
http://www.ifokr.org/bri/     forwards, it installs WindowsXP!"

Every message PGP signed

--EE8jvUPYYQjJtG7J
Content-Type: application/pgp-signature
Content-Disposition: inline

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.2.1 (GNU/Linux)

iD8DBQE/Z9+bidaA3abfMooRAulqAJ4oSFF3ULJPjZ8Zdz8JaAzT+CzoYACfQQ3u
VGyt4tsa5TvQTK4HRbIFMco=
=ZtQz
-----END PGP SIGNATURE-----

--EE8jvUPYYQjJtG7J--