4

As described at New attack bypasses HTTPS protection on Macs, Windows, and Linux | Ars Technica, there is a newly identified attack at wifi hotspots etc that can expose the URLs you use even if they are HTTPS urls. This is a problem especially when those URLs contain secrets, which happens more often than one might think. It will be described more at the Black Hat security conference in Las Vegas in a talk titled Crippling HTTPS with Unholy PAC.

According to How to Disable WPAD on Your PC So Your HTTPS Traffic Won't Be Vulnerable to the Latest SSL Attack « Null Byte, WPAD is enabled by default with Internet Explorer, but not in Mac OS X or Linux, nor on Safari, Chrome, or Firefox browsers.

That article gives instructions for how to disable WPAD in Windows. But how can I check whether it has been enabled on other browsers or operating systems in my organization? And are there other settings to look at, e.g. around PAC?

Improve this question
1
  • If you are using Chrome on a Windows machine, Chrome will use your operating system's proxy settings. You can verify this by searching for 'proxy' in Chrome settings. For other browsers, I'd suggest looking at their settings pages as well and see if there's anything that might override the system's proxy settings. To be thorough, we have to check the proxy settings and disable WPAD through the OS and also through individual browsers. After disabling WPAD, Chrome should report an effective direct connection without any original connections specified; see chrome://net-internals/#proxy – Kevin Lee Apr 11 '17 at 13:03
2

https://technet.microsoft.com/en-us/library/cc985352.aspx

You can use the Group Policy settings to manage the default browser settings on your users' computers. For administrators managing users' computers in an Active Directory® environment, the Administrative Templates in Group Policy provide policy settings for locking most configuration settings in Internet Explorer 8 after deployment.

This page may be out of date, but I imagine the capabilities still exist, and should basically solve the concern for IE and perhaps Chrome browsers in your AD domain. I believe group policy settings will stick for laptops temporarily unconnected to your domain, but it's been a long time since I had to use group policy.

I haven't found clear information on the current state of Chrome and Firefox, but it appears these browsers default to 'no proxy' which doesn't attempt to grab these pac files. Unfortunately, this doesn't guarantee that these settings weren't imported from older versions or changed by the user, and I'm not aware of a clean way to check them remotely.

You might be able to bind the standard location of the pac files to localhost using the hosts file, or you might detect these machines on your network using an IDS audit.

Improve this answer
1
  • Chrome on Windows defaults to using Windows settings, which in turn defaults to automatically detecting for proxies. So we have to turn it off from the Windows proxy settings. – Kevin Lee Apr 11 '17 at 13:07

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.