(forw) Re: [sf-lug] https hack
Rick Moen <rick-IyCrq+X4Fdq2oZ/[email protected]>
| Newsgroups | gmane.org.user-groups.linux.svlug |
|---|---|
| Organization | If you lived here, you'd be $HOME already. |
| Message-ID | <[email protected]> |
----- Forwarded message from Rick Moen <[email protected]> ----- Date: Thu, 11 Aug 2016 18:10:20 -0700 From: Rick Moen <[email protected]> To: [email protected] Subject: Re: [sf-lug] https hack Quoting maestro ([email protected]): > New attack bypasses HTTPS protection on Macs, Windows, and Linux< > http://arstechnica.com/security/2016/07/new-attack-that-cripples-https-crypto-works-on-macs-windows-and-linux/ No. Headline notwithstanding, it's not new. It's been pretty well understood since at least 2013. The only thing that's new is that Blackhat USA 2016 just occurred, and, as is traditional, somebody (Itzik[1] Kotler & Amit Klein) demo'ed stuff. The key to all this is that Netscape Corporation back in Netscape Navigator 2.0 days (1996) had a very, very bad idea: proxy auto-configuration (PAC) and a Web Proxy Auto-Discovery Protocol (WPAD) for Web browsers. http://users.telenet.be/mydotcom/library/network/pac.htm https://en.wikipedia.org/wiki/Proxy_auto-config https://en.wikipedia.org/wiki/Web_Proxy_Autodiscovery_Protocol https://web.archive.org/web/20110807125044/http://www.wlug.org.nz/WPAD PAC/WPAD has _always_ been ripe for abuse, and, starting 2013, people got around to doing so in a serious way. And, in 20156, Kotler & Klein tied up how to do so in a neat bow. So: Proxy auto-configuration is bad. There's a long history of building dangerous, overfeatured functionality by default into the Web. See also: Javascript. Jonathan de Boyne Pollard wrote more than a decade ago about these things (PAC and WPAD). http://jdebp.eu./FGA/web-browser-auto-proxy-configuration.html Quoting: o Only configure web browsers to use PAC scripts published by entities that you trust. o Don't enable "DHCP-based" Web Proxy Auto-Discovery (WPAD) unless you trust all of the DHCP servers on the network you are attaching to. o Don't enable "DNS-based" Web Proxy Auto-Discovery (WPAD) unless you trust all of the content HTTP servers that could possibly be contacted. I simply disable blanket-proxies. Done. https://auth0.com/blog/heads-up-https-is-not-enough-when-using-wpad/ Go forth and do ye likewise. Today's puzzler: _Without_ Web-searching the phrase, can any non-Norwegians in present company guess what my .signature says? [1] Great name, Itzik (אִיצִיק). Means 'laughter'. Not that Amit (עָמִית) isn't nice too, mate. (It means friend or, er, 'mate'.) -- Cheers, Luftputebåten min er full av ål. Rick Moen [email protected] McQ! (4x80) ----- End forwarded message ----- _______________________________________________ svlug mailing list [email protected] http://lists.svlug.org/lists/listinfo/svlug