The Star recently published an article describing an alleged attack against a Moroccan journalist. The article describes the attack as such:

Forensic evidence gathered by Amnesty International on Radi’s phone shows that it was infected by “network injection,” a fully automated method where an attacker intercepts a cellular signal when it makes a request to visit a website. In milliseconds, the web browser is diverted to a malicious site and spyware code is downloaded that allows remote access to everything on the phone. The browser then redirects to the intended website and the user is none the wiser.

There's also an accompanying schematic summarising the attack set up:

Diagrammatic representation of "network injection" attack

Some quick googling seems to indicate that "network injection" is actually a euphemism for packet injection.

In this specific case (i.e., attacking cellular internet connections),

  1. Does HTTPS provide adequate protection from such an attack?
  2. If not, why?

From the article:

The website must use “clear text” which means the URL starts with “http” not “https.”

The technique described in the article sounds hardly different from a man in the middle (MitM) attack, at least in terms of the potential impact.

Just like in a MitM scenario where an attacker can read and modify all data on the wire, TLS (therefore HTTPS) retains confidentiality and integrity as long as certificates are used and trusted properly. Without knowing the server's private key and the victim's session key(s), the traffic cannot reasonably be viewed or modified at that level.

  • 1
    Admittedly, I did miss the text you quote in my initial run of the article. My intuition certainly tells me that this isn't that special of an attack from a security perspective, but I thought it safe to defer to the community for an answer.
    – jmcph4
    Jun 24 '20 at 4:53

These attacks can be broken down in two (three) vectors:

  1. Network data interception;
  2. Inspection and/or tampering of network traffic;
  3. (Infection of device by attacker controlled software);

Point 1) is achieved using against a mobile or wireless connection by using dedicated equipment, in this particular case a stingray van that impersonates a network tower and routes all of the device's traffic via itself.

Aspect 2) depends on 1) and is straight forward for any plain text protocols like HTTP and DNS. Encrypted protocols won't naturally be visible unless there's a way to decrypt them by brute forcing or to defeat the mechanism somehow. A TLS connection (used to wrap HTTP in HTTPS) in a device that has not been compromised ensures that data is encrypted from end to end, and is generally not feasible to decrypt (as with everything there's exceptions to this rule).

If the device is infected by malicious software (vector 3), then everything changes. Depending on the level of control achieved by the attacker, it would be possible to even skip step 1) to enable traffic inspection. Usually malware monitors activity and, to contribute to defeating TLS, installs a trusted root CA certificate. In conjunction with TLS aware inspection software, this ensures that servers appear to the device as valid, trusted TLS endpoints, when they are in reality fabricated endpoints used to terminate the encrypted connection at the inspection software. This permits inspection and tampering of traffic that is seen by the client to be within a TLS tunnel.

Wrapping everything up and tying it to the article, it would have been possible to execute vector 1, use 2 to tamper with all plaintext traffic to inject an exploit with malware to enable 3. All this is possible and feasible, given enough effort.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.