TLS/SSL and password transmission

Question

I am still getting confused with security topics. At the moment the advantages and disadvantages of some of authentication methods are still not very clear. According to OWASP Authentication Cheat Sheet, the password should be only transmitted over tls because of the following Statement:

"Failure to utilize TLS for the login landing page allows an attacker to modify the login form Action".

My first question is: whether the statement above is automatically implicit whenever the password is not transmitted over TLS/SSL. Because normally no TLS/SSL means there is no confidentiality, integrity and replay protection for this Password but I don't understand what the form Action has to do with it. a part from the fact that there is a possibility to view the Password some where.

My second question is: Is it possible in practice for an attacker to manipulate the login form? how can the attacker manipulate the login form if he has no access to the server data..? because for instance if the entire page is programmed in php, how could the attacker do that. could you give me an example. I hope to have be more precised.

Answer 1

You're right: missing TLS is a far greater problem than just modifying the login form's action. Have a look at the full paragraph from the link you provided:

The login page and all subsequent authenticated pages must be exclusively accessed over TLS. The initial login page, referred to as the "login landing page", must be served over TLS. Failure to utilize TLS for the login landing page allows an attacker to modify the login form action, causing the user's credentials to be posted to an arbitrary location. Failure to utilize TLS for authenticated pages after the login enables an attacker to view the unencrypted session ID and compromise the user's authenticated session

As @user2313067 points out, OWASP is addressing a common misconception "that by setting https in the action of the form on an http page, you have no guarantee that the client will receive it unmodified, and it might point to a page the attacker controls. Putting https on subsequent pages but not on the login form only protects you against passive attacks"

Specifically to answer your questions:

1. Yes, the password is exposed if you fail to use TLS.
2. Internet traffic is not guaranteed to take any particular route across the Internet - one packet can go one way and the next packet can go through totally different networks. Changing the form action avoids the risk that the victim's password will go over a different network and the attacker won't be able to intercept it. Of course, this is really not necessary to understand why missing crypto is important or the basics of how network traffic interception works; it adds complexity to the particular discussion in question without need. It could be better discussed on a different page. But then OWASP is free, volunteer driven, and doesn't seem to rigorously enforce any real organization to what content goes on what page.
3. Yes. If network traffic is not encrypted with strong crypto then it can be modified in flight. There are two main ways to do this. First, the attacker proxies the connection between you and the server. You are now talking to the attacker. The attacker can send you anything they want. Second, the attacker sees the response from the server as it travels in the clear over the network and replaces it with their own response. Your computer cannot tell the difference between the valid response and the malicious response so it just trusts the first response it receives. The attacker pays tricks to make sure its response is received first and you get the (part of the) page returned by the attacker not by the server.