Phrack Magazine
phrack.org
Phrack Magazine
1–10 of 22 posts
Re: Phrack Magazine
#2[flagged]
Re: Phrack Magazine
#3[flagged]
[deleted]
Re: Phrack Magazine
#4[flagged]
It has immense security implications. Without transport encryption, an adversary performing a MITM attack can, in certain circumstances, completely rewrite the entire HTTP response from the server. That includes everything from adding a tracking pixel to, at the extreme, serving some webasm exploit for your browser, plus a sandbox escape, to get code execution in (your) userland... where they could quickly and easily dump and exfil saved passwords from all browsers, crypto wallets, etc.
Extreme example, but code execution is code execution.
I'd hope that PHRACK readers would be among those better prepared for such attacks, but case in point, lack of transport encryption for web traffic is ABSOLUTELY a security issue too, not just a privacy issue.
Re: Phrack Magazine
#5[flagged]
It has immense security implications. Without transport encryption, an adversary performing a MITM attack can, in certain circumstances, completely rewrite the entire HTTP response from the server. That includes everything from adding a tracking pixel to, at the extreme, serving some webasm exploit for your browser, plus a sandbox escape, to get code execution in (your) userland... where they could quickly and easily…
The problem is that HTTPS has become something of a cult in tech circles.
Not every web site needs HTTPS.
It matters not at all if some government sees me checking the weather, or reading about the best seeds to plant this time of year.
And 99 44/100% of the MITM hype is pure theoretical hysteria. There is a very long distance between "could" and "will" and "can" and "did."
I know a lot of people enjoy their paranoia fantasies. But real life isn't a Tom Cruise movie.
Re: Phrack Magazine
#6Earlier quoted context omitted.
It has immense security implications. Without transport encryption, an adversary performing a MITM attack can, in certain circumstances, completely rewrite the entire HTTP response from the server. That includes everything from adding a tracking pixel to, at the extreme, serving some webasm exploit for your browser, plus a sandbox escape, to get code execution in (your) userland... where they could quickly and easily…
The problem is that HTTPS has become something of a cult in tech circles. Not every web site needs HTTPS. It matters not at all if some government sees me checking the weather, or reading about the best seeds to plant this time of year. And 99 44/100% of the MITM hype is pure theoretical hysteria. There is a very long distance between "could" and "will" and "can" and "did." I know a lot of people enjoy their paranoia…
> Not every web site needs HTTPS.
Every site does. HTTPS should be the default, that increases security even if you're just looking at cat pictures in a given context.
> It matters not at all if some government sees me checking the weather, or reading about the best seeds to plant this time of year.
Absolutely does. Much can be deduced from your activity, like whether you're home, what your interests are, who you talk to, what skills you have. If somebody gets poisoned, then your interest in botany might suddenly make you of interest.
For the most part nobody really wants to read your boring emails. But that you regularly talk to some controversial person, or spend a lot of time in their proximity, that's juicy information that may well paint a target on your back in the wrong circumstances.
> And 99 44/100% of the MITM hype is pure theoretical hysteria. There is a very long distance between "could" and "will" and "can" and "did."
Good news: it absolutely happens. MITM has been used for injecting ads in content, which of course can be used to nefarious effect. From just unethical, like replacing a site's original ads with your own and robbing them of the income, to actually malicious payloads.
Re: Phrack Magazine
#7Spoiler for anyone else that got excited: nothing new has been published.
Re: Phrack Magazine
#8Earlier quoted context omitted.
It has immense security implications. Without transport encryption, an adversary performing a MITM attack can, in certain circumstances, completely rewrite the entire HTTP response from the server. That includes everything from adding a tracking pixel to, at the extreme, serving some webasm exploit for your browser, plus a sandbox escape, to get code execution in (your) userland... where they could quickly and easily…
The problem is that HTTPS has become something of a cult in tech circles. Not every web site needs HTTPS. It matters not at all if some government sees me checking the weather, or reading about the best seeds to plant this time of year. And 99 44/100% of the MITM hype is pure theoretical hysteria. There is a very long distance between "could" and "will" and "can" and "did." I know a lot of people enjoy their paranoia…
Holy shit man, ISPs are notorious for injecting ads and other garbage into web pages. Back when I had Comcast (Xfinity) they'd inject giant pop-up windows in web pages served over HTTP if I was approaching the asinine bandwidth limits. I also noticed an uptick in tracking ads on pages served over HTTP.
Your ISP and mobile carriers are not trustworthy neutral carriers of data. Encrypted transports are the only way for end users to avoid their snooping and injection.
Re: Phrack Magazine
#9Spoiler for anyone else that got excited: nothing new has been published.
New content is clearly not a requirement for posting old links on hn :). This was a little experiment to see how it compares to the overthewire links which show up every few months.
Interesting difference in reactions, the actual hacker content gets a yawn :).
Re: Phrack Magazine
#10[flagged]
It has immense security implications. Without transport encryption, an adversary performing a MITM attack can, in certain circumstances, completely rewrite the entire HTTP response from the server. That includes everything from adding a tracking pixel to, at the extreme, serving some webasm exploit for your browser, plus a sandbox escape, to get code execution in (your) userland... where they could quickly and easily…
Do you trust certificate authorities? Do you trust the Chinese govt? Russian?
While I agree in principal, in practice https is not very resilient to the attacks you mentioned because CAs are demonstrably [1,2,3] not trustworthy despite being baked into your browser.
1: https://en.m.wikipedia.org/wiki/DigiNotar
2: https://therecord.media/mongolian-certificate-authority-hack...
3: https://arstechnica.com/information-technology/2022/11/state...