From following news, http://thehackernews.com/2012/12/etsy-for-iphone-loophole-allows.html

Someone just setup a proxy to intercept traffic between browser and https protocol, then it called vulnerability for 750 USD?


4 Answers 4


The article simply doesn't contain enough information to asses the situation. Sending a password (without further encryption/hashing) over SSL/HTTPS is secure, if SSL is used correctly.

Perhaps the certificate validation was insufficient, allowing a MitM on SSL. (One of the comments claims that this was the case for your example.) If you don't validate the certificate the server sends to you, an attacker can impersonate the server. In such a scenario the information still gets encrypted, but with a key the attacker chooses.

Against active attackers, SSL is only as secure as your certificate validation.

  • 1
    But that security researcher just puts proxy BETWEEN browser and HTTPS, the result is not unexpected all data in plain text same case if I puts proxy to capture every HTTPS websites on the Internet then I can captures those clear text as well because it just captured BEFORE encrypted through SSL. Dec 17, 2012 at 19:10
  • @catalyze HTTP proxy does not intercept the traffic before it is encrypted with TLS, the browser actually creates an HTTPS tunnel through the proxy, using the CONNECT verb. All HTTPS traffic is encrypted by TLS before it leaves the browser.
    – AviD
    Dec 19, 2012 at 14:01

According to the article, the login credentials were sent in cleartext upon submission. This is definitely a critical vulnerability as an attacker doesn't really need any other information to take over the user account and do whatever they please with it.

  • 1
    But login credentials were sent over https? Dec 16, 2012 at 4:51

A vulnerability simply refers to the fact that password and username are send out in clear text. Important data should always be encrypted.

With information in clear text man in the middle attack can be use to sniff the traffic and modifying it for the attacker own purpose.

  • The information is probably sent encrypted. But an active attacker can impersonate the server if certificate validation is insufficient. Dec 16, 2012 at 15:56
  • username and password are sent in clear text though.. it would be weird if everything is send in clear text except for username and password.
    – Len
    Dec 16, 2012 at 16:00
  • I don't think they're sent as clear text. The screenshot shows that SSL was used. So it's extremely likely they were encrypted, and it was a certificate validation weakness. But since the article is badly written, we can't say for sure what the issue was. Dec 16, 2012 at 16:01
  • "He logged in his Etsy account from iPhone and Burp Suite proxy captured the requests with respective username & password , which was actually sent in clear text."
    – Len
    Dec 16, 2012 at 16:25
  • I guess the article was badly written, and called a password sent of SSL "clear text". Dec 16, 2012 at 16:42

Perhaps the app does its tls login via a flawed iPhone function; that flaw would be that its bypassable by configuring your phone's OS network settings. (Some employers/government may tell/force employees to custom configure their phones/browsers.)

Otherwise, it would be as you have said—the 750 USD makes no sense if the app didn't even try to use tls in the first place (unless it's for PR/marketing), which is the state of zillions of apps on the market.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .