I can see login credentials on Facebook while using Maxthon browser

Question

So i've noticed something that really bothered me and i was kinda freaked out about how it's even possible. But i didn't want to come here just like "Hey, how is this possible?" so i wanted to make proprer research and i eventually found the answer(almost-that's why i am here). I am also here, because i am deffinitely not the only one, who is wondering how is this possible, so i want to point this problem out a bit.

So i was at my friend's and i wanted to just quickly demonstrate him MitM attack via android app ZAnti. It is really powerful app and i wanted to show him, what an attacker could see when doing (ARP) MItM. So i was showing him many interesting things and i said to him, that if the page is using HTTPS, i can see nothing, but it's still pretty dangerous. Well, he wanted to see so he logged onto his facebook and his password popped up on my phone... And it was at this moment i knew, something isn't right here.

He absolutely freaked out but it blew my mind. At this moment, we started to make theories about how those Chinese devs of Maxthon hacked NSA/FBI, stole their private SSL/TLS keys of facebook and now they are using them and silently stealing peoples' facebook accounts. Well, this is obviously not true.

Anyway, first thing that came to my mind was this site and how i need to post question about this asap. But i wanted to give you enough data to work with so we could collectively figure something out. So i will start posting the """research""" as it is deffinitely worth checking out.

First i needed to replicate the attack. I fired up my Opera browser and tried the same thing. Nothing. Absolutely nothing. I didn't even see that i connected to facebook(because ZAnti filters https requests as they are useless). So i tried hrej.cz(it's just local webpage that i know is http and i use it when i want to make sure my MitM is working) and it was there. So it's working.

So it was really because of Maxthon so i went to download it and try it again. And i saw. It was there. The app uses SSLstrip by default so i thought that it might be because of that, but facebook uses HSTS so it wouldn't make any sense. But as i checked the URL bar my security brain part died for a second. I was browsing facebook via HTTP.

I am sorry for my localization. It's all in Czech but i will try to translate the most important

The green bar says that the site is "certified by CEAIA".

But facebook uses HSTS! Well, as it turned out, facebook really does, but Maxthon doesn't support it. And this is where i answered my question but it raised another one. Why facebook still process http requests ? I mean, facebook could just block it and not even allow it. Where is the catch ?

By the way, Maxthon was among other browsers recommended for Win10 when my friend installed it for the first time. Kinda scary that it's so insecure.

Answer 1

It's pretty simple. As you say, and Maxthon does not yet support HSTS. So for this reason Maxthon will be susceptible to MITM attacks unless you specifically use the https:// prefix for www.facebook.com.

The green bar says that the site is "certified by CEAIA".

I find it misleading that they would show the site as certified when the connection is insecure. Perhaps I mis-understand the meaning of this message from Maxthon?

Why facebook still process HTTP requests?

Probably this is not true. (except that they would provide HTTP 301 redirects to the secure site in addition to an HSTS header)

The more likely case is that SSLStrip is communicating with Facebook over HTTPS. Only Maxthon thinks it is HTTP because of SSLStrip.

By the way, Maxthon was among other browsers recommended for Win10 when my friend installed it for the first time. Kinda scary that it's so insecure.

It's insecure if someone is tampering with your connection and you forget to use the https bookmark.