Tell me more ×
IT Security Stack Exchange is a question and answer site for IT security professionals. It's 100% free, no registration required.
up vote 1 down vote favorite

From following news, http://thehackernews.com/2012/12/etsy-for-iphone-loophole-allows.html

Someone just setup a proxy to intercept traffic between browser and https protocol, then it called vulnerability for 750 USD?

share|improve this question

3 Answers

up vote 3 down vote

The article simply doesn't contain enough information to asses the situation. Sending a password (without further encryption/hashing) over SSL/HTTPS is secure, if SSL is used correctly.

Perhaps the certificate validation was insufficient, allowing a MitM on SSL. (One of the comments claims that this was the case for your example.) If you don't validate the certificate the server sends to you, an attacker can impersonate the server. In such a scenario the information still gets encrypted, but with a key the attacker chooses.

Against active attackers, SSL is only as secure as your certificate validation.

share|improve this answer
But that security researcher just puts proxy BETWEEN browser and HTTPS, the result is not unexpected all data in plain text same case if I puts proxy to capture every HTTPS websites on the Internet then I can captures those clear text as well because it just captured BEFORE encrypted through SSL. – catalyze Dec 17 '12 at 19:10
@catalyze HTTP proxy does not intercept the traffic before it is encrypted with TLS, the browser actually creates an HTTPS tunnel through the proxy, using the CONNECT verb. All HTTPS traffic is encrypted by TLS before it leaves the browser. – AviD♦ Dec 19 '12 at 14:01
up vote 2 down vote

According to the article, the login credentials were sent in cleartext upon submission. This is definitely a critical vulnerability as an attacker doesn't really need any other information to take over the user account and do whatever they please with it.

share|improve this answer
But login credentials were sent over https? – catalyze Dec 16 '12 at 4:51
up vote 0 down vote

A vulnerability simply refers to the fact that password and username are send out in clear text. Important data should always be encrypted.

With information in clear text man in the middle attack can be use to sniff the traffic and modifying it for the attacker own purpose.

share|improve this answer
The information is probably sent encrypted. But an active attacker can impersonate the server if certificate validation is insufficient. – CodesInChaos Dec 16 '12 at 15:56
username and password are sent in clear text though.. it would be weird if everything is send in clear text except for username and password. – Lennon Chia Dec 16 '12 at 16:00
I don't think they're sent as clear text. The screenshot shows that SSL was used. So it's extremely likely they were encrypted, and it was a certificate validation weakness. But since the article is badly written, we can't say for sure what the issue was. – CodesInChaos Dec 16 '12 at 16:01
"He logged in his Etsy account from iPhone and Burp Suite proxy captured the requests with respective username & password , which was actually sent in clear text." – Lennon Chia Dec 16 '12 at 16:25
I guess the article was badly written, and called a password sent of SSL "clear text". – CodesInChaos Dec 16 '12 at 16:42

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.