I was wondering if the following scenario was realistically achievable.
We have a Network with a Computer that is used by Bob. He is security conscious person and uses a password manager. His computer is connected to the internet through a router which Bob got from his ISP. The ISP and the manufacturer of the router have not deployed updates for critical vulnerabilities that his router has.
Then there is Trudy who really wants to know Bobs passwords. She gets full access to his router through an exploit. There are a couple websites she is interested in so she manipulates the DNS entries to point to a webserver under her control. As Trudy has a lot of time, it is assumed that the DNS cache of Bob's computer will eventually be updated to contain the manipulated entries.
Bob happens to connect to a website Trudy is interested in. He thinks he is establishing a connection with
https://www.safewebsite.com, but in fact he connecting to Trudy's webserver. The webserver downgrades the connection to plain http, just to establish the connection. Then the webserver performs a redirect to the actual URL of itself, e.g.
https://safewebsite.evil.com for which Trudy has a valid (simple) SSL Certificate. Assuming Bob does not look too closely he doesn't see the difference in the address bar.
Alternatively Trudy gets Bob to visit her webserver in a way that does't trigger an invalid certificate exception.
What Trudy needs to do, in order to extract Bobs password, is to embed the valid website Bob wanted to visit. This also happens to be less work for Trudy as she doesn't want to code a phishing website, but wants to trick Bob's password manager. When Bob would visit Trudy's malicious website the password manager enters his credentials into the embedded website, because he believes that this is a valid connection. Then a script from Trudy's website grabs the content of the password field and username, sending both to the webserver.
Now Trudy does have a thing she is struggling with, a lot of websites have the x-frame-option set to deny. This foils Trudy's attempt in many cases. She has the idea to let the Router sniff for packets containing the x-frame-option. It would then be modified or removed. So if Bob visits Trudy's malicious website, he requests the embedded real website and the router performs an active MITM. This means the router connects to
https://www.safewebsite.com and only hands Bob the http version. Bob would still see the
https://safewebsite.evil.com, not indicating a visual change compared to the previous version of the attack. The question is if the router would be able to remove or modify the x-frame-option in a way that doesn't impact Bob's browsing experience.
Hopefully the idea is clear. If you spot something that is unrealistic, please leave a comment. Maybe you have an even simpler idea how to achieve this.
This is a attack scenario against a specific password manager (which will not be named here) that I would like to use in a presentation for a course at university, but only if it is plausible.
Even though I knew and have thought this through several times, the written idea above has a crucial flaw,
www.safewebsite.com would need to be loaded as https otherwise the password manager would not fill in the data. I will work on the scenario and post an updated version.
It seems that the password manager does have a security issue filling credentials into iframes. The scenario is flawed though and the answers given are correct for the original question. If the new scenario does work, I will first contact the developers and later release more information about the problem.