Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Http://www.google.com/wo0dh3ad

news.ycombinator.com

Post reply on HN
Print view View original

11–20 of 37 posts

Re: Http://www.google.com/wo0dh3ad

#11

Post by pornel »

wladimir wrote: post #3

Proves again, there is really no excuse not to use HTTPS for everything. Encryption/certificate validation make it much harder to pull of a MITM attack like this, especially by companies and small repressive governments.

http://www.google.co.uk/search?q=site%3Atn+inurl%3Ahttps

Quite a few of Tunisian websites are signed by "Agence Nationale de Certification Electronique".

Also, there so many intermediate CA's that I find it hard to believe that the system isn't broken:

https://www.eff.org/files/colour_map_of_CAs.pdf (via https://www.eff.org/observatory)

We already had UAE government successfully MITM-ing SSL by forcing CyberTrust-delegated CA to forge a certificate:

http://www.schneier.com/blog/archives/2010/09/uae_man-in-the...

Re: Http://www.google.com/wo0dh3ad

#12

Post by wladimir »

jrockway wrote: post #6
wladimir wrote: post #3

Proves again, there is really no excuse not to use HTTPS for everything. Encryption/certificate validation make it much harder to pull of a MITM attack like this, especially by companies and small repressive governments.

I guess SSL is an improvement. Now you just have to trust 2000 companies and anyone controlling their purse strings, instead of having to trust everyone. You feel safe, which is much better than being safe...

Yes, it's not perfect either. It won't stop the NSA or even China's government. But it would stop me, and probably you, from pulling this trick :)

Using SSL(TLS) everywhere would go a long way toward security. It's much preferable over plaintext.

I really loathe arguments like "it's not perfectly secure, so let's use something even less secure". Making it harder means a larger investment for the attacker, especially as they have to do the certificate trick for each individual site instead of some simple interception blanket.

Re: Http://www.google.com/wo0dh3ad

#13

Post by wladimir »

_b8r0 wrote: post #8
wladimir wrote: post #3

Proves again, there is really no excuse not to use HTTPS for everything. Encryption/certificate validation make it much harder to pull of a MITM attack like this, especially by companies and small repressive governments.

The simple answer for small repressive governments is to block the HTTPS login form so you have to fall back to HTTP. ATI has complete control of all Internet access in Tunisia. You're just not going to get through them unless you can find a way through. In some countries I work in we routinely come across censorship and all kinds of dodgy goings on, so we have a variety of tunnelling methods (VPN, SSH, ICMPTX, DNSTX…

Of course, governments can completely block port 443, but that will make so many internet sites unusable they could just as well completely pull the plug.

And with 'HTTPS everywhere', I also mean removing the HTTP fallback. Fallbacks to plaintext (that can be triggered by a MITM) are indeed obvious backdoors that should be avoided in any protocol.

Re: Http://www.google.com/wo0dh3ad

#14

Post by SimplePast »

_b8r0 wrote: post #8
wladimir wrote: post #3

Proves again, there is really no excuse not to use HTTPS for everything. Encryption/certificate validation make it much harder to pull of a MITM attack like this, especially by companies and small repressive governments.

The simple answer for small repressive governments is to block the HTTPS login form so you have to fall back to HTTP. ATI has complete control of all Internet access in Tunisia. You're just not going to get through them unless you can find a way through. In some countries I work in we routinely come across censorship and all kinds of dodgy goings on, so we have a variety of tunnelling methods (VPN, SSH, ICMPTX, DNSTX…

Correct ! Facebook https is already blocked !

Re: Http://www.google.com/wo0dh3ad

#15

Post by wladimir »

pmjordan wrote: post #5
wladimir wrote: post #3

Proves again, there is really no excuse not to use HTTPS for everything. Encryption/certificate validation make it much harder to pull of a MITM attack like this, especially by companies and small repressive governments.

With this scale of access to the network infrastructure[1], I'd be worried about them injecting drive-by downloads of browser exploits which install trust for a root certificate controlled by the government. Once in place, MITM attacks on https are possible. The tricky bit would be telling apart requests from compromised machines and uncompromised ones. (attempting to MITM the latter will cause the browser to start j…

If you want scary, what about bribing Intel and AMD to include 'propietrary instructions' for your government?

Re: Http://www.google.com/wo0dh3ad

#16

Post by pmjordan »

wladimir wrote: post #15
pmjordan wrote: post #5

Earlier quoted context omitted.

With this scale of access to the network infrastructure[1], I'd be worried about them injecting drive-by downloads of browser exploits which install trust for a root certificate controlled by the government. Once in place, MITM attacks on https are possible. The tricky bit would be telling apart requests from compromised machines and uncompromised ones. (attempting to MITM the latter will cause the browser to start j…

If you want scary, what about bribing Intel and AMD to include 'propietrary instructions' for your government?

Seems a little far-fetched and overly complicated for carrying out a practical attack.

Re: Http://www.google.com/wo0dh3ad

#17

Post by wladimir »

pmjordan wrote: post #16
wladimir wrote: post #15

Earlier quoted context omitted.

If you want scary, what about bribing Intel and AMD to include 'propietrary instructions' for your government?

Seems a little far-fetched and overly complicated for carrying out a practical attack.

Yes, but at least it would work for practically everything, and it seems most effective to start at the source if you're bribing big companies anyway. If you bribe Microsoft you'll only get the IE (and possibly Windows) users, and privacy-minded individuals will likely be avoiding those already.

Also it's pretty much impossible to patch and protect against, even if you know the exploit exists.

Re: Http://www.google.com/wo0dh3ad

#18

Post by pmjordan »

wladimir wrote: post #17
pmjordan wrote: post #16

Earlier quoted context omitted.

Seems a little far-fetched and overly complicated for carrying out a practical attack.

Yes, but at least it would work for practically everything, and it seems most effective to start at the source if you're bribing big companies anyway. If you bribe Microsoft you'll only get the IE (and possibly Windows) users, and privacy-minded individuals will likely be avoiding those already. Also it's pretty much impossible to patch and protect against, even if you know the exploit exists.

You'd still need some kind of software support to trigger the exploit. At which point you may as well go with a software-only attack.

Re: Http://www.google.com/wo0dh3ad

#19

Post by chaitanya »

mooism2 wrote: post #7
wladimir wrote: post #3

Proves again, there is really no excuse not to use HTTPS for everything. Encryption/certificate validation make it much harder to pull of a MITM attack like this, especially by companies and small repressive governments.

I agree TLS should be more widely used. But... When the government or ISP in question controls its own certificate authority (and many do), they can MITM you even over HTTPS. Yes, it's another speedbump for them to get over. No, it's not going to stop them. The X.509 security model is broken and needs fixing or replacing.

Are there any certifying authorities which can be considered relatively free of government/corporate control?

Re: Http://www.google.com/wo0dh3ad

#20

Post by wladimir »

pmjordan wrote: post #18
wladimir wrote: post #17

Earlier quoted context omitted.

Yes, but at least it would work for practically everything, and it seems most effective to start at the source if you're bribing big companies anyway. If you bribe Microsoft you'll only get the IE (and possibly Windows) users, and privacy-minded individuals will likely be avoiding those already. Also it's pretty much impossible to patch and protect against, even if you know the exploit exists.

You'd still need some kind of software support to trigger the exploit. At which point you may as well go with a software-only attack.

Naah, if it's simply a few added instructions I agree with you.

But let's think in a wider scope (disclaimer: this is not my idea, I remember reading about it a long time ago): what if a certain cryptographic "magic code" at the beginning of a memory page would trigger the execution of arbitrary code embedded in that page?

Such a thing could be triggered over the network, wireless through bluetooth/wifi, or by specially crafted images on a webpage, or whatever creative technique you can think of. It'd effectively give the govt instant root access to any device with the affected CPUs.

Post reply on HN