If I want to go to https://www.example.com, can my ISP instead give me a different https website instead but make it look like it came from https://www.example.com If they do, will my browser tell me that I have the wrong website and if so, is that true for all of IE, Firefox and Chrome?
Add a comment
|
2 Answers
If you connect such domain the certificate is checked by your browser. The certificate of the HTTPS server must be signed with one of certificate of certification authority your computer trusts. If it is not signed by it you will see warning from your browser the connection can't be trusted.
If ISP will be able to manage the certificate is signed by one of these certification authorities (or add another certification authority to your trusted certification authorities) you will not be able to notice it until you know, what CA issued the correct certificate for the server and you will check it manually in the browser.
This will never happen under "normal" conditions as public certification authorities will never issue certificate to anybody else than the server (domian) owner. And in order the ISP is able to install another certificate to your trusted CA store they have to somehow hack your PC or provide you a malicious code in some way (i.e. they give you a CD with some "drivers"). But its not that easy as it seems and I would say no ISP will risk something like this.
Edit: I forgot to mention that is server will use insecure protocol (i.e. SSLv2) with insecure encryption suite there is also possibility the MITM can happen.
-
Does this answer apply? security.stackexchange.com/a/106723/71375 . I am not familiar with all the terms.– SimdCommented May 31, 2017 at 6:29
-
Seems yes, it also applies. But it describes in another words what I mentioned.– FisCommented May 31, 2017 at 6:31
-
The ISP does not need to be malicious or infect. They can simply require that their customers install their cert in order to get service. This happens today.– schroeder ♦Commented May 31, 2017 at 6:32
-
Would you do that? Me not. Or I would like to know the reason of that. In some countries, this can be a requirement. I can imagine that in China where everything is being monitored you are asked to do exactly this. On other hand, when I have been there I have been able to use SSL VPN with no restrictions and with no need to install any ISP certificate.– FisCommented May 31, 2017 at 6:34
-
First, if you want to go to https://yourdomain.com then whatever browser you are using will first check your DNS server to check if there is any IP address listed against yourdomain.com. If you are using your ISP-provided DNS server then they can list a fake phishing webserver's IP address against yourdomain.com in their DNS server. So when your browser requested that IP you will redirect to the phishing website. This attack is called DNS poisoning. You are specifying ISP scenario that is why I am ignoring ARP cache poisoning option.
Now, if you are trying to access phishing site with https then whatever browser you are using should warn you about a security issue. Because the website you are trying to visit cannot provide proper certification details to your browser. Usually when a browser tries to access a legitimate website via https then the website provides proper certificate containing its digital signature and public key. Then the browser takes this certificate and verifies it against its list of trusted certificate authorities. If everything checks out then the connection between web server and browser get encrypted via webserver's private key. This communication also can be breached by an MITM method called SSL hijacking.
Here is a good documentation of how Digital Certification and SSL works. Also check here.
