Today I realized that many "secured" web sites reference their secure login page from an insecure page. For example:
http://www.some-luser.com/login.html: <form action="https://cgi.some-luser.com/login-cgi";> user: <input name=user> pass: <input name=pass> </form> The actual post is secure (several assumptions made), but not the page which contains the form itself! In my mind, it would be rather trivial to man-in-the-middle or DNS poison www.some-luser.com and change the content of login.html's form-action to http://not-secure-luser.com/login-cgi. If Eve hosts not-secure-luser.com then login credentials will be posted to her rather than to where it is expected. With some javascript magic, Eve could even post the victim back into https://cgi.some-luser.com/login-cgi. Except for the extra delay and perhaps a "please wait while you are logged in" page (ajax anyone?), Bob *and* Alice would never know. Am I missing something here? Are "secure" web designers really overlooking the obvious? -Eric -- Eric Wheeler Vice President National Security Concepts, Inc. PO Box 3567 Tualatin, OR 97062 http://www.nsci.us/ Voice: (503) 293-7656 Fax: (503) 885-0770 -- Here's a topic: foo. Discuss amongst yourselves ... _______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/
