Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

I remember reading about an attack where the "location bar" in a user's browser displays a valid URL (e.g. https://www.paypal.com/), but the traffic is really being directed to or intercepted by an attacker. How can this be accomplished, and what can end-users do to ensure a URL they are visiting is what it claims to be?

Edit: I don't remember if the attack was talking about HTTP or HTTPS, so my question applies to both.

share|improve this question
add comment

4 Answers

up vote 4 down vote accepted

Performing an attack on an https:// address without change of URL would require :

  • certificate impersonation (someaon has stolen private keys of the site) + DNS poisoning
  • I think it would be possible to do it also by tampering the hosts file on someone system, but would still require a valid certificate.

To ensure not being hijacked this way, always be certain that your browser is up to date and certificates too. Certificate can be render invalid and the CRL (Certificate Revocation List) should be checked whenever you have to use a certificate (via OCSP -Online Certificate Status Protocol - or so). I do not remember how browsers handle this type of request.

share|improve this answer
    
Thanks. I've edit my question to clarify I'm asking about either HTTP or HTTPS. –  jrdioko Jul 10 '11 at 22:35
add comment

Do you mean where the attacker registers a domain that looks similar to a "real" one, but using non-English (or rather, non-Latin) characters?

See

  1. http://en.wikipedia.org/wiki/IDN_homograph_attack
  2. http://en.wikipedia.org/wiki/Internationalized_domain_name
  3. http://www.shmoo.com/idn/homograph.txt
share|improve this answer
add comment

If the attacker can do man-in-the-middle (e.g. wireless or if he is able to get anywhere in between you and the site you want to visit) then they can spoof DNS, use something like sslstrip (http://www.thoughtcrime.org/software/sslstrip/) to trick you, or really do any content manipulation they want.

For HTTPS, check out: Can a HTTPS connection be compromised because of a rogue DNS server

share|improve this answer
    
Yes, except that this trick will not lead to a https://www.paypal.com/ address bar (unless the user clicks through a certificate warning) -- but it could lead to a http://www.paypal.com/ address bar. In other words, the attack you posit works, but the user will see a HTTP (not HTTPS) URL in their address bar -- assuming the user does not click through a certificate warning (if the user does click through warnings, all bets are off). –  D.W. Jul 11 '11 at 0:26
add comment

There is also the family of attacks where the browser correctly shows whatever the attacker wants it to show, but the traffic still goes to the malicious website, either through a simple DNS hijacking (where the browser has the correct URL but it resolves to an incorrect IP address) or low level hijacking of browser code to separate the displayed information from that in the application itself.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.