HTTPS and cache injection

Question

I understand the downside of this attack and what wrong can be done.

But I dont understand how is it done ?

Well, I need to educate myself, any pointers would be useful.

Answer 1

I suggest reading the paper. Section 3 (the section on cache injection) is clear and well-written.

The attack is pretty simple. Assume that you connect over open Wifi, and an active attacker is present and mounting a man-in-the-middle attack against you. The attacker could serve malicious content for a Javascript library used by some major site: say, https://twitter.com/jquery.js (let's assume that's a Javascript library used by Twitter). The attacker will have to use an invalid SSL certificate, so you'll get a warning pop-up; the attack assumes you'll click through that warning. Your browser will cache the content it received for https://twitter.com/jquery.js, so it now has malicious Javascript cached for that URL.

The consequence is that if you later visit Twitter over a secure network, your browser may still have the malicious Javascript library cached and use the malicious version. Thus, the attacker can maintain control for a longer period than you might expect.

In the grand scheme of things, I think this attack is of lesser severity. It requires the attacker to mount a MITM attack on you. It requires you to click through cert warnings. And if you do those two things, you're already in trouble anyway.

Best defenses: Try to avoid using open Wifi. Try to avoid clicking through cert errors. Certainly never click through cert errors when you are on open Wifi. If you want to be especially careful, set up a VPN and always use it any time you are on a third-party Wifi network.