New attack that cripples HTTPS crypto works on Macs, Windows, and Linux
http://arstechnica.com/security/2016/07/new-attack-that-cripples-https-crypto-works-on-macs-windows-and-linux/
A key guarantee provided by HTTPS encryption is that the
addresses of visited websites aren't visible to attackers who
may be monitoring an end user's network traffic. Now,
researchers have devised an attack that breaks this
protection. The attack can be carried out by operators of
just about any type of network, including public Wi-Fi
networks, which arguably are the places where Web surfers need
HTTPS the most. It works by abusing a feature known as
WPAD--short for Web Proxy Autodisovery--in a way that exposes
certain browser requests to attacker-controlled code. The
attacker then gets to see the entire URL of every site the
target visits. The exploit works against virtually all
browsers and operating systems. It will be demonstrated for
the first time at next week's Black Hat security conference in
Las Vegas in a talk titled Crippling HTTPS with Unholy PAC.
- - -
--Lauren--
Lauren Weinstein ([email protected]): http://www.vortex.com/lauren
Founder:
- Network Neutrality Squad: http://www.nnsquad.org
- PRIVACY Forum: http://www.vortex.com/privacy-info
Co-Founder: People For Internet Responsibility: http://www.pfir.org/pfir-info
Member: ACM Committee on Computers and Public Policy
Lauren's Blog: http://lauren.vortex.com
Google+: http://google.com/+LaurenWeinstein
Twitter: http://twitter.com/laurenweinstein
Tel: +1 (818) 225-2800 / Skype: vortex.com
I have consulted to Google, but I am not currently
doing so -- my opinions expressed here are mine alone.
_______________________________________________
pfir mailing list
http://lists.pfir.org/mailman/listinfo/pfir
