7

The website I am using is using HTTP for retrieval of the page. In the page they ask you to enter credit card details that then go via HTTPS (to another server). They claim that this is secure enough (as it seems that no sensitive info ever travels unencrypted) and it might look so at first glance.

Using a simple MITM attack, attacker can modify webpage JS by adding an event listener that posts card details to the attackers server on submit of the form (that have all the card details). The user and the server wouldn't notice anything strange and the transaction could complete successfully. Is my understanding correct of the situation? Is it really unsafe?

And also, is MITM attack something that is very hard to perform, or is it doable with minimal hacking? How is it when comparing Public Wifi, Home Wifi and Cable internet?

Sorry for some broadness, I would appreciate some insight or links

  • 2
    You're entirely right that entering cc details on an http page is unsafe, for the exact reason you stated. – Pascal Mar 6 '17 at 21:58
  • There's a reason HSTS is a thing like Buffalo5ix says, and there's a reason why most sites will offer the entire session in https. – Ijustpressbuttons Mar 8 '17 at 0:07
7

I'll do my best to answer each aspect of your question, but keep in mind that this is a broad topic with many intricate details.

first things first:

They claim that this is secure enough (as it seems that no sensitive info ever travels unencoded)

Semantic correction - the word you want is unencrypted, not unencoded. Encoding means that the data is easily reversible, and encryption is in place to prevent an attacker from reversing the encrypted data back to the original value.

Using a simple MITM attack, attacker can modify webpage JS by adding an event listener that posts card details to the attackers server on submit of the form (that have all the card details). The user and the server wouldn't notice anything strange and the transaction could complete successfully. Is my understanding correct of the situation? Is it really unsafe?

Your understanding is not quite correct for HTTPS sites. Because the data is encrypted, your MITM wouldn't be able to make any changes to the traffic. Remember, the encryption happens between the victim and the website - your MITM proxy doesn't have any control over the encryption. Therefore, all it sees is encrypted data - this makes it impossible to edit on the fly and insert malicious code. Your understanding is correct for HTTP sites, however. MITM attackers are able to manipulate traffic, including injecting malicious scripts.

There is an attack called SSLstrip in which an attacker MITMs the HTTPS encryption by downgrading the user to HTTP (changing https:// to http://). This works because the victim browser thinks the attacker is the website, and the website thinks the attacker is the victim. This is prevented in most websites nowadays by the inclusion of the HSTS header which tells the browser to only access the site through HTTPS. There is a more robust and fairly nontechnical article on this attack here: https://avicoder.me/2016/02/22/SSLstrip-for-newbies/

And also, is MITM attack something that is very hard to perform, or is it doable with minimal hacking? How is it when comparing Public Wifi, Home Wifi and Cable internet?

MITM is incredibly easy to perform. All wifi traffic is broadcasted - this means that any nearby sniffing devices can read your traffic. If you're connecting to a page through HTTP over public/unencrypted wifi you can assume that whatever information you are sending and receiving is public - all it takes is an attacker nearby with an antenna to read all that in plaintext. To perform a true MITM by having traffic flow through them, attackers can use technologies like WiFi pineapples or aircrack-ng to force users to connect to their wifi network.

You might have heard of WPA/WPA2 wifi encryption. This is the current standard for wifi encryption - if you're connecting to your home router with WPA2 you can be reasonably confident that an external attacker can't intercept your data. WEP has been obsolete for a long time - do not trust WEP encryption to keep your connection secure. Keep this in mind whenever your connect to an open (unencrypted) network - your laptop/phone will generally warn you of this before you connect.

Connecting over cable internet is much harder to intercept/mitm because you're not broadcasting your traffic for the whole neighborhood. In order to compromise this network an attacker will have to gain access to it somehow - either through physical access to a network port, malware installed on a host machine or router, etc. When an attacker has access to a network they then have to exploit that access through attacks such as ARP poisoning or HSRP spoofing. These attacks just MITM traffic - anyone on the network can still sniff (read, but not change) traffic, but keep in mind HTTPS traffic is still encrypted and can't be read.

  • I definitely meant encryption and not encoding, thanks – eddyP23 Mar 6 '17 at 22:31
  • Also, sorry if I didn't make it clear, I didn't mean that HTTPS traffic can be read or changed. I do understand the concept of encrypting all of the traffic (when HTTPS is used) and breaking HTTPS is a quite hard maths problem :) – eddyP23 Mar 6 '17 at 22:35
  • Almost all - agree. MITM for HTTPS can be performed by SSL bumping, where an Attacker becomes a server for the client and client for the server. So, it unencrypts traffic. Not easy to implement (CA trusts), but possible.As for Wi-Fi, WPA2 with AES - only one secure standing. WEP is compromised as long as TKIP. Anyway, present days require to use TLS for any resource, sensitive to user data (cards, passwords etc) and I would not trust to any resource that still offers sales online without SSL protection – ETech Mar 7 '17 at 0:21
  • great points, I added a bit about WEP obsolescence and SSL downgrade attacks. – Buffalo5ix Mar 7 '17 at 0:53
  • @avicoder That's a fantastic post, thank you for writing it! – Buffalo5ix Mar 22 '17 at 16:58
-1

A MITM attack is possible even on a secure "https" connection. If an eavesdropper intercepts the public key in the initial exchange, he can dicipher subsequent messages from the owner of that key and forward those messages along to any other unwitting recipient using his own public key. This is true of both the initiator of the communication as well as any recipient who replies. As long as the attacker is in the middle, intercepting messages, he can use his own public key to forward the sender's message to the recipient after monitoring the message's contents. To mitigate this problem, modern Web browsers contain a list of trusted third parties that can verify that a given public key is owned by a particular entity. This is true of Web servers but usually not true of human users of Web browsers, who don't generally want to be burdened with the cost and responsibility of pinning a public key to their own online identity.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.