37

I recently did an experiment using MitM to gain account information (username and password) while accessing websites. I used two PCs in the scenario; one as the target, running Internet Explorer, and one as the attacker, running ettercap. One attempt (pretending to be steamcommunity.com) yielded information; the target accepted the attacker's fake CA self-signed certificate presented via the MitM attack. The other attempt (pretending to be facebook.com) didn't even allow me to add an exception for the self-signed certificate on the target machine. So the question is, why did one website allow me to add an exception while the other one didn't?

47

Facebook uses HSTS (with preload[*]) while steamcommunity.com doesn't.

HTTP Strict Transport Security is a HTTP header that has two effects:

  1. It forces all connections to the site over HTTPS (even if it was accidentally linked/bookmarked/typed as HTTP)
  2. It aborts if any HTTPS error or warning exists. This includes self-signed certificate warnings, which means that it is impossible to accept these certificates.

[*] preload means that the browser is aware of HSTS even before the first visit. Without preload, you could perform a man in the middle attack on the very first request to the site, even if HSTS exists.

  • 1
    It may be important to explain that 'preload' means that the browser is aware of the site using HSTS, even before first communication. So in those cases you can't even exploit the first transaction to the site to perform a downgrade attack. – MiaoHatola Mar 11 '17 at 11:03
  • 1
    @MiaoHatola good point, I added it – tim Mar 11 '17 at 11:07
  • 2
    Does preloading mean there's literally a hardcoded list of sites inside my browser's install binary? If so, are those lists coordinated anywhere between vendors? What if I wanted to get my site onto that list? – Robbie Wxyz Mar 11 '17 at 16:48
  • 4
    @RobbieWxyz Yes, it's managed by the browser. For using it, see here. As preload is difficult to reverse, it is important to follow their recommendations. – tim Mar 11 '17 at 16:53
  • 3
    @Pierrot Just check the HTTP header. For example via curl -I https://facebook.com/. It shows Strict-Transport-Security: max-age=15552000; preload, so we know that it uses HSTS (although the preload directive does not follow the requirement to have includeSubDomains set, so it may be excluded from the preload list in the future). – tim Mar 11 '17 at 18:18

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.