171–180 of 358 posts
Earlier quoted context omitted.
I think that by "every keystroke" he meant "every network packet".
Which would capture passwords in plaintext sent from the user side, no?
Earlier quoted context omitted.
It could use something like bdfproxy[1] to intercept HTTP-downloaded EXE files, then add some persistent malware in _addition_ to whatever the EXE was doing. This has been done before, over Tor[2]. The malware doesn't have to add a new root certificate, either, though that's completely possible. The Zeus trojan [3] does "man-in-the-browser" to intercept banking information, for example. [1] https://github.com/secrets…
so the spoofer distributing these devices is going to all this trouble/expense/risk in the hope there is a http downloaded exe it can corrupt, then hopes the hashing doesn't fail on that corrupt exe, and hopes the user ignores the untrusted source warning so that it can install a trojan?
Earlier quoted context omitted.
For example you can go to my http://website.com now the normal website has a HTTPS redirect on home page. Your router replaces that page and disables the redirect. Now is up to you to notice you're on a http connection. If you think is rare, I can tell you some fortune 500 FX and stocks trading have this vulnerability a year ago (didn't checked again).
This is why certificate pinning and modern web security practices are so important. On a well configured site, this attack would fail.
HSTS is useless in this case isn't it?
> I have a Raspberry Pi right now in my hands fron rentyouraccont.com, i have it running diagnostics on an Air-Gapped pc. This thing is wild. Every second it tries to connect to bot-net programs. It not only buys ads on facebook (which btw i cannot find code that it actually does this) but it is creating links to malware ridden embeds. It is part of a Botnet, i can say for sure. Every second it tries to establish a c…
How is that even possible? How does it capture keystrokes (unless you mean Google searches where each key is sent for autocomplete). How does it break SSL?
Earlier quoted context omitted.
At a previous employer (Fortune 500, not a software co.) the IT security team would sometimes seed the parking lots with thumb drives that were "infected" with a program that would phone home to them if plugged into a PC on the corporate network. IIRC there was a depressingly high (> 50%) rate of them being plugged in.
I’m not sure I understand what the big deal is unless your machine tries to run software automatically from devices that are plugged into it. If you plug something into a centOS machine it’s not going to be able to do anything until you mount it and even then why would code be able to run from it?
Earlier quoted context omitted.
This is why certificate pinning and modern web security practices are so important. On a well configured site, this attack would fail.
If you had never visited the site, how would modern security practices have prevented the attack? HSTS is useless in this case isn't it?
Technically, if the domain had DNSSEC enabled, it might prevent this kind of attack, but no regular consumer is using a validating stub resolver, so even DNSSEC wouldn't work.
Now that browsers are saying "Not Secure" by default for HTTP pages, users are apparently expected to notice this popping up where it didn't before and realizing they're on a phishing site.
Earlier quoted context omitted.
Which would capture passwords in plaintext sent from the user side, no?
Yes, but browsers give huge warnings about password fields on non-SSL sites. Password in the clear won't happen with any major website.
Do you see any warnings in your browser? I see no warnings in Chrome.
Earlier quoted context omitted.
Which would capture passwords in plaintext sent from the user side, no?
Yes, but browsers give huge warnings about password fields on non-SSL sites. Password in the clear won't happen with any major website.
The only defense is HSTS/certificate-pinning, for sites previously visited with that browser & device (it’s a TOFU security model).
HN has HSTS, but not Reddit, or my credit union, or my local pizza place, or Kaiser Permanente, etc. etc. etc.
EDIT: I believe e.g. Chrome and Firefox bake in some major certificates, which would also likely flag MITM attacks, for those sites.
EDIT II: Someone responded below (since deleted) that you’d also need that cert to be signed by a CA your browser trusts, which is true. My explanation is faulty/poor. Better informed discussion of attacks further down the thread!
Earlier quoted context omitted.
This is why certificate pinning and modern web security practices are so important. On a well configured site, this attack would fail.
If you had never visited the site, how would modern security practices have prevented the attack? HSTS is useless in this case isn't it?
Earlier quoted context omitted.
Yes, but browsers give huge warnings about password fields on non-SSL sites. Password in the clear won't happen with any major website.
The box controls the DNS; majorwebsite.com points to any sever the attacker likes. The only defense is HSTS/certificate-pinning, for sites previously visited with that browser & device (it’s a TOFU security model). HN has HSTS, but not Reddit, or my credit union, or my local pizza place, or Kaiser Permanente, etc. etc. etc. EDIT: I believe e.g. Chrome and Firefox bake in some major certificates, which would also like…