FalseCONNECT Fejl Stopper HTTPS trafik, Påvirker Apple, Microsoft, Google
CYBER NEWS

FalseCONNECT Fejl Stopper HTTPS trafik, Påvirker Apple, Microsoft, Google

1 Star2 Stars3 Stars4 Stars5 Stars (Ingen stemmer endnu)
Loading ...

falseconnect_flow-forskning-stforum

En ny sårbarhed, som kan sætte en række produkter på risiko er blevet netop offentliggjort af sikkerhed forsker Jerry Decime. Han har afsløret chokerende detaljer om fejlen, døbt FalseCONNECT. Ifølge Decime analyse, the vulnerability can allow a Man-in-the-Middle attack and intercept HTTPS traffic. This would be due to flaws in the deployment of proxy authentication procedures in multiple products. Mere præcist, a flaw exists in how specific applications respond to HTTP CONNECT requests via the HTTP/1.0 407 Proxy Authentication Required responses.

Relaterede: Printer Sårbarhed Da Windows 95 Put Hele Enterprises at Risk

A Deeper Look into the FalseCONNECT Vulnerability

Kort sagt:

Mistakes were made in the implementation of proxy authentication. This in turn resulted in numerous vulnerabilities with the implementations of theHTTP/1.0 407 Proxy Authentication Requiredresponse to CONNECT requests across a broad range of operating systems, ansøgninger, and browsers for any device configured to use a proxy and even some that weren’t with auto-proxy support enabled by default in Windows.

It’s important to note that the flaw exists only in network environments. This is where users apply proxy connections. The setup is mostly popular in enterprise networks in which powerful firewalls are set in place. If an attacker has access to a compromised network and could listen to proxy traffic, he could also easily sniff for HTTP CONNECT requests sent to the local proxy.

Once such a request is intercepted by an attacker, he can reply to it instead of the real proxy server. Derefter, the attacker can issue a 407 Proxy Authentication Required response where the user is asked for a password to access a service.

Why Is the Vulnerability Called FalseCONNECT? Vendors Affected

HTTP connect requests are unencrypted and an attacker would know when the target wants to access sensitive accounts. This can happen even when the services are HTTPS.
Who Is Affected by FalseCONNECT?

In the researcher’s own words:

The worst of these vulnerabilities [er] impacting Apple, which until the release of the iOS 9.3.3 update manifested as a complete failure of HTTPS trust in iOS, all versions since at least iOS 5.1.1 for OS trust components, Safari, Opera, and applications utilizing WebKit when using proxies.

Desuden, the researcher found that WebKit software is more vulnerable than others.

What Is WebKit?

WebKit is a layout engine software component for rendering web pages in web browsers. WebKit also powers Apple’s Safar, and a fork of the project is used by Chromium-based browsers, like Google Chrome and Opera. US-CERT has alerted thatWebKit-based clients are vulnerable to additional vectors due to the fact that HTML markup and JavaScript are rendered by the client Document Object Model (DOM) in the context of the originally requested HTTPS domain.”

Apple, Microsoft, Oracle and Opera have already endorsed their products affected by the flaw. Other vendors are still calculating the risks of FalseCONNECT and the impact it can have on their products. The list includes Linux distros, Cisco, HP, IBM, Google, Juniper, Nokia, Mozilla, SAP, Sony, etc.

Vendors can test for this vulnerability using an intercepting proxy such as The Fiddler. It supports the CONNECT interception. A bit of FiddlerScript after the OnBeforeResponse function is all that is needed, the researcher adds.

More information about this serious flaw is available on FalseConnect’s dedicated page.

Milena Dimitrova

En inspireret forfatter og indhold leder, der har været med SensorsTechForum for 4 år. Nyder ’Mr. Robot’og frygt’1984’. Fokuseret på brugernes privatliv og malware udvikling, hun tror stærkt på en verden, hvor cybersikkerhed spiller en central rolle. Hvis almindelig sund fornuft giver ingen mening, hun vil være der til at tage noter. Disse noter senere kan blive til artikler!

Flere indlæg

Efterlad en kommentar

Din e-mail-adresse vil ikke blive offentliggjort. Krævede felter er markeret *

Frist er opbrugt. Venligst genindlæse CAPTCHA.

Del på Facebook Del
Loading ...
Del på Twitter Tweet
Loading ...
Del på Google Plus Del
Loading ...
Del på Linkedin Del
Loading ...
Del på Digg Del
Del på Reddit Del
Loading ...
Del på Stumbleupon Del
Loading ...