0

Supposing an attacker is able to perform a Man In The Middle attack and intercept requests from a client that wants to connect to an HTTPS server (let's say www.google.com).

The attacker has a valid certificate (domain : www.randomname.com) signed by Verizon.

He will then redirect the client to his fake server.

Normally, there will be no warning as the certificate is signed by a trusted CA.

Is this a way to bypass HTST protection?

2

Normally, there will be no warning as the certificate is signed by a trusted CA.

Wrong. Since the subject of the certificate ( www.randomname.com) does not match the URL (www.google.com) the validation will fail and the browser complain. It does not matter if this is "only" a redirect, i.e. even for the domain you redirect from you need a proper certificate.

  • The domain name check mecanism is provided by HSTS right? – Duke Nukem Jul 25 '16 at 18:38
  • 1
    @DukeNukem: No, the check of the subject against the name in the URL is part of the normal certificate validation and is done even without HSTS or similar. Without this check man in the middle attacks would be trivial. – Steffen Ullrich Jul 25 '16 at 18:49

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.