How to check for vulnerability against WPAD / HTTPS attacks?

Question

As described at New attack bypasses HTTPS protection on Macs, Windows, and Linux | Ars Technica, there is a newly identified attack at wifi hotspots etc that can expose the URLs you use even if they are HTTPS urls. This is a problem especially when those URLs contain secrets, which happens more often than one might think. It will be described more at the Black Hat security conference in Las Vegas in a talk titled Crippling HTTPS with Unholy PAC.

According to How to Disable WPAD on Your PC So Your HTTPS Traffic Won't Be Vulnerable to the Latest SSL Attack « Null Byte, WPAD is enabled by default with Internet Explorer, but not in Mac OS X or Linux, nor on Safari, Chrome, or Firefox browsers.

That article gives instructions for how to disable WPAD in Windows. But how can I check whether it has been enabled on other browsers or operating systems in my organization? And are there other settings to look at, e.g. around PAC?

Answer 1

https://technet.microsoft.com/en-us/library/cc985352.aspx

You can use the Group Policy settings to manage the default browser settings on your users' computers. For administrators managing users' computers in an Active Directory® environment, the Administrative Templates in Group Policy provide policy settings for locking most configuration settings in Internet Explorer 8 after deployment.

This page may be out of date, but I imagine the capabilities still exist, and should basically solve the concern for IE and perhaps Chrome browsers in your AD domain. I believe group policy settings will stick for laptops temporarily unconnected to your domain, but it's been a long time since I had to use group policy.

I haven't found clear information on the current state of Chrome and Firefox, but it appears these browsers default to 'no proxy' which doesn't attempt to grab these pac files. Unfortunately, this doesn't guarantee that these settings weren't imported from older versions or changed by the user, and I'm not aware of a clean way to check them remotely.

You might be able to bind the standard location of the pac files to localhost using the hosts file, or you might detect these machines on your network using an IDS audit.