37

I recently did an experiment using MitM to gain account information (username and password) while accessing websites. I used two PCs in the scenario; one as the target, running Internet Explorer, and one as the attacker, running ettercap. One attempt (pretending to be steamcommunity.com) yielded information; the target accepted the attacker's fake CA self-signed certificate presented via the MitM attack. The other attempt (pretending to be facebook.com) didn't even allow me to add an exception for the self-signed certificate on the target machine. So the question is, why did one website allow me to add an exception while the other one didn't?

Improve this question
0

1 Answer 1

Reset to default
47

Facebook uses HSTS (with preload[*]) while steamcommunity.com doesn't.

HTTP Strict Transport Security is a HTTP header that has two effects:

  1. It forces all connections to the site over HTTPS (even if it was accidentally linked/bookmarked/typed as HTTP)
  2. It aborts if any HTTPS error or warning exists. This includes self-signed certificate warnings, which means that it is impossible to accept these certificates.

[*] preload means that the browser is aware of HSTS even before the first visit. Without preload, you could perform a man in the middle attack on the very first request to the site, even if HSTS exists.

Improve this answer
8
  • 1
    It may be important to explain that 'preload' means that the browser is aware of the site using HSTS, even before first communication. So in those cases you can't even exploit the first transaction to the site to perform a downgrade attack.
    – MiaoHatola
    Commented Mar 11, 2017 at 11:03
  • 1
    @MiaoHatola good point, I added it
    – tim
    Commented Mar 11, 2017 at 11:07
  • 2
    Does preloading mean there's literally a hardcoded list of sites inside my browser's install binary? If so, are those lists coordinated anywhere between vendors? What if I wanted to get my site onto that list?
    – Robin
    Commented Mar 11, 2017 at 16:48
  • 4
    @RobbieWxyz Yes, it's managed by the browser. For using it, see here. As preload is difficult to reverse, it is important to follow their recommendations.
    – tim
    Commented Mar 11, 2017 at 16:53
  • 3
    @Pierrot Just check the HTTP header. For example via curl -I https://facebook.com/. It shows Strict-Transport-Security: max-age=15552000; preload, so we know that it uses HSTS (although the preload directive does not follow the requirement to have includeSubDomains set, so it may be excluded from the preload list in the future).
    – tim
    Commented Mar 11, 2017 at 18:18

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .