Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

I recently starting using the Calomel SSL Validation plugin for Firefox to test the SSL security on the sites I visit. When navigating to American Express' log in page, I noticed Calomel reports the encryption is "broken and insecure".

I then ran an HTTP analyzer on the requests from the HTTPS AmEx log in page and found the following:

POST http://ocsp.verisign.com/
GET  http://ad.doubleclick.net/crossdomain.xml
POST http://evintl-ocsp.verisign.com/
POST http://evsecure-ocsp.verisign.com/

These 4 requests are, from what I can tell, the cause of the SSL warnings I'm seeing. The Verisign requests look to be checking the status of the issued cert and the cross-domain request for DoubleClick is getting the cross-domain policy info.

Are these requests putting the SSL connection at risk by being over HTTP? I noticed none are sending any AmEx cookies.

Is checking the certificate status via an insecure HTTP OCSP POST safe to do during an SSL connection?

share|improve this question
1  
I don't think title matches post. –  schroeder Jun 24 '13 at 20:04
    
How does it not match? I'm browsing a webpage via SSL that is making cross-domain HTTP requests, and I'm wondering if those present any vulnerabilities to the SSL connection. –  Mike G. Jun 24 '13 at 22:17

1 Answer 1

up vote 2 down vote accepted

This question is entirely dependent on what content is being loaded and what browser you are using. (Which is information that is curiously missing form this post)

Chrome by default will avoid mixed-content vulnerabilities by loading resources over HTTPS if possible. Firefox will be introducing this security feature shortly. IE lacks many modern security features, and is especially vulnerable to Mixed Content vulnerabilities.

If you are loading JavaScript from an HTTP source on an HTTPS page, then the entire page is compromised. An attacker could introduce arbitrary JavaScript and read any content within that session (similar to XSS). Flash objects that have allowscriptaccess enabled will also have access to any content within this HTTPS session. CSS is normally not a concern, however, Internet Explorer allows you to embed JavaScript within CSS, which would allow an attacker to read arbitrary content within the session.

So what about images and video? Well you could Goatse someone (kids still do this right?) or flip images upside down, but that is less of a concern than reading credit card numbers or obtaining a user's password or reading a cookie with the Secure flag set.

In the URLS above OCSP requests are usually in plaintext. Hijacking a crossdomain.xml isn't much of a concern, especially when the file in question already has the least secure rule-set possible:

<allow-access-from secure="false" domain="*"/>
share|improve this answer
    
FWIW I'm using Firefox but I left the browser out because it was a general question about hijacking via crossdomain.xml and OCSP over HTTP. Thanks, this answered it for me. –  Mike G. Jun 25 '13 at 13:34

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.