Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

UC Browser for Android, Desktop Exposes 500M Users to MiTM Attacks

bleepingcomputer.com

Post reply on HN
Print view View original

41–50 of 62 posts

Re: UC Browser for Android, Desktop Exposes 500M Users to MiTM Attacks

#41

Post by joombaga »

austincheney wrote: post #36
Spare_account wrote: post #28

Earlier quoted context omitted.

> Man in the middle only involves encryption. This doesn't feel right to me, so I would like to explore it if you are willing to help me understand. I've grabbed a couple of sources below which appear to contradict your assertion, but I'll admit I'm not expert on this topic so if I'm misunderstanding things, I'd appreciate being put right. The Wikipedia article you linked to includes the following section: > A notabl…

The OWASP definition is correct. The gist of a MITM is that each end of the transmission trusts that the malicious actor in the middle is the target destination. When this occurs at the application layer it is almost universally centered on encryption. Keep in mind that in TCP/OSI terms the web is an application riding the internet. Without encryption how do you trust that the destination is who they claim to be? MIT…

> The OWASP definition is correct.

Okay. Your definition, with its additional encryption requirement, is at odds with the OWASP definition.

> Without encryption how do you trust that the destination is who they claim to be?

Signing? Or just ignorance? I agree that "trust" is a component, but it doesn't have to make sense. I can still fool you and the server to which you're connecting into thinking I'm the other party.

Re: UC Browser for Android, Desktop Exposes 500M Users to MiTM Attacks

#42

Post by joombaga »

gruez wrote: post #34
Spare_account wrote: post #28

Earlier quoted context omitted.

> Man in the middle only involves encryption. This doesn't feel right to me, so I would like to explore it if you are willing to help me understand. I've grabbed a couple of sources below which appear to contradict your assertion, but I'll admit I'm not expert on this topic so if I'm misunderstanding things, I'd appreciate being put right. The Wikipedia article you linked to includes the following section: > A notabl…

Yes, technically because it's conducted by someone in the middle of the transport path, you can call it man in the middle. The problem is that if you call all attacks that, what do you call the attack where asymmetric key exchange is being replicated by some attacker in the middle? Also, it's possible to pull this particular attack off without being in the "middle",. For example, by using DNS cache poisoning or arp s…

> The problem is that if you call all attacks that, what do you call the attack where asymmetric key exchange is being replicated by some attacker in the middle?

You use a more exact term. I don't see the problem.

Re: UC Browser for Android, Desktop Exposes 500M Users to MiTM Attacks

#44

Post by deadmetheny »

austincheney wrote: post #20
ggggtez wrote: post #14

Earlier quoted context omitted.

What are you talking about... It is man in the middle. This attack is a lot older than encryption, so if you think encryption is required then you've made a big mistake. It refers to literally a person intercepting your message before (or instead of) it reaching the intended audience.

Older than encryption? Encryption has existed since before the Roman empire. > It refers to literally a person intercepting your message before (or instead of) it reaching the intended audience. Every time somebody has pointed that out they have extracted that definition from the term opposed to referencing the term from a definition. It is similar to answering a question with only a restatement of the question.

MitM attacks have been around far longer than transport/network layer encryption has been commonly deployed, is what parent means. These days it's more commonly used to defeat encryption but there's plenty of attacks that don't really need it (e.g. ARP spoofing, etc etc)

Re: UC Browser for Android, Desktop Exposes 500M Users to MiTM Attacks

#45

Post by richrichardsson »

austincheney wrote: post #20
ggggtez wrote: post #14

Earlier quoted context omitted.

What are you talking about... It is man in the middle. This attack is a lot older than encryption, so if you think encryption is required then you've made a big mistake. It refers to literally a person intercepting your message before (or instead of) it reaching the intended audience.

Older than encryption? Encryption has existed since before the Roman empire. > It refers to literally a person intercepting your message before (or instead of) it reaching the intended audience. Every time somebody has pointed that out they have extracted that definition from the term opposed to referencing the term from a definition. It is similar to answering a question with only a restatement of the question.

I would be confident in saying MITM attacks have existed even longer than encryption.

- A dispatches messenger towards B.

- Bad actor intercepts messenger.

- Bad actor detains/kills messenger.

- Bad actor dresses up in messenger clothing.

- Bad actor delivers message to B as if they were the original messenger, having read/altered the message in the meantime.

Re: UC Browser for Android, Desktop Exposes 500M Users to MiTM Attacks

#46

Post by onionsoup »

max_wen wrote: post #4

People really use this browser?

It was the the largest browsers in Indonesia and India, at least in part because it's marketed as saving $$ on data by blocking calls to download ads and other scripts[1][2].

[1] https://www.scmp.com/tech/article/2130205/alibabas-uc-mobile... [2]https://marketingland.com/alibabas-uc-browser-beating-google...

Re: UC Browser for Android, Desktop Exposes 500M Users to MiTM Attacks

#47

Post by baybal2 »

onionsoup wrote: post #46
max_wen wrote: post #4

People really use this browser?

It was the the largest browsers in Indonesia and India, at least in part because it's marketed as saving $$ on data by blocking calls to download ads and other scripts[1][2]. [1] https://www.scmp.com/tech/article/2130205/alibabas-uc-mobile... [2] https://marketingland.com/alibabas-uc-browser-beating-google...

While downloading gigabytes of own ads...

Re: UC Browser for Android, Desktop Exposes 500M Users to MiTM Attacks

#50

Post by bgee »

zoom6628 wrote: post #35

FWIW UC Browser is prob the most popular web browser used on Android phones in China. Every device ive seen, or owned, has it pre-loaded or is top choice for getting loaded. I have also tried it out myself, but as other posters has written already, its awful. Wondering out loud i would ask if the vulnerability to MiTM is actually required. From reports here in HN 2-3 years ago MiTM is basically what the GFW achieves,…

> and it inserts its own headers to route away from intended(and blocked) servers and to benign local China servers(such as baidu)

I was never aware that GFW would route traffic to local China servers such as Baidu's, can you kindly provide some links?

Post reply on HN