Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

I heard that a security issue exists in some cases when a mobile phone has:

  1. Connected to a website via https via 3G
  2. Connects to a router

I'm told that that in this particular scenario the router maintains the https connection but the connection from the phone to the router is http.

Has anyone heard of this issue? Can anyone confirm or deny it?

share|improve this question
    
So the connection to the router is not using SSL to encrypt, but the connection to the site still utilizes SSL? Question is a bit unclear. If that is the scenario, the traffic to the website, as long as it's https, would still be encrypted.(provided no MiTM is going on) You may want to clarify your question a bit more. –  g3k Feb 21 '13 at 15:31

2 Answers 2

up vote 0 down vote accepted

If the phone switches networks, then it would have to create a new connection. The router can behave the way you describe only by having a server listen on port 80 (HTTP) and then proxying data back and forward to a different session over HTTPS.

A simple configuration issue cannot produce the necessary servers and proxying behavior for your scenario to be valid.

There is the SSLStrip attack that is similar to your description but it involves many more steps.

share|improve this answer

...and I heard they found a B52 bomber on the moon.

Certainly there are some browsers which do not use HTTP/HTTPS to connect to a website but rather a proprietary protocol is used to connect to a translating proxy. IIRC Opera and RIM browsers still do this - as to whether the encryption follows the URL....you'd need to do a bit more digging, however increasingly phones behave in the same way as any other device.

Although SPDY (and hence HTTP/2.0) have a lot more throughput, there are performance issues and security issues with a device which changes IP adress in the middle of a HTTP (and a TLS) session - but these should not cause loss of the encryption layer.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.