Consider the following scenario giving a hypothetical attack:
Crypto.com is selling cryptostocks and accepts payments using a payment processor PayEasy.com. The entire site pages (of crypto.com) are served using HTTPS.
While traveling in a foreign country, Bob visits crypto.com on his laptop from his hotel network and clicks on the “buy now” button for 10 cryptostocks. He is forwarded to PayEasy.com using a link
- An attacker (such as the ISP) manages to redirect all traffic intended for
PayEasy.comfrom Bob’s computer to a fake site he has set up called
PayEazy.com. When Bob makes a DNS query for PayEasy.com, the attacker returns the IP address of PayEazy.com.This site also has an HTTPS connection using a genuine SSL obtained from a CA using "domain-validation". The certificate confirms that the site is served by payeazy.com. An attacker must do this, since otherwise Bob’s browser will give a warning and may fail the attack. Thus, Bob effectively clicks a link equivalent to
- Bob never suspects anything because he sees the green bar and he has not even bothered to read on crypto.com’s site that it uses PayEasy.com. Even if Bob did know that PayEasy.com is crypto.com’s payment processor, he does not notice the slight difference in PayEazy.com. Bob makes the payment of $100 for 10 cryptostocks and waits but they never arrive.
- Bob assumes Crypto.com is a scammer and sues them. As the case unfolds, Crypto.com’s lawyers ask Bob to prove that Crypto.com sent him to https://PayEazy.com instead of https://PayEasy.com. Bob cannot prove this and loses. The case could have gone either way since even Crypto.com could not have proved that they indeed sent Bob to https://PayEasy.com and not https://PayEazy.com
Firstly, is this attack realistic. Secondly, how to prevent it? (This is similar to the example given in the article Schneier's PalmPilot)
As an example of this attack: https://google.com is a secure link to
google.com. Assuming that this site (
security.stackexchange.com) is served over HTTPS. Now edit your 'hosts.file' so that the IP address of
google.com points to
yahoo.com and click the above link.