0

i am trying to login to my yahoo mail, but no avail. i recently discovered after monitoring some traffic that the dumb yahoo server doesn't send a close_notify response but just acts ignorantly and closes the ssl session. i know if i do this i may be vulnerable to truncation attacks, but i will disable it as soon as i import everything i have from yahoo and then delete my yahoo account. i want to bypass the close_notify verification in firefox (or iceweasel as you want to call it). thanks.

i'll also quote a comment that has been made in the pidgin support board. it's down here:

Both GnuTLS and CDSA (Adium's SSL plugin) check whether a TLS connection has been closed properly by checking if the server sent a close_notify alert first. [https://bugzilla.mozilla.org/show_bug.cgi?id=508698 NSS doesn't]. If that alert wasn't sent, GnuTLS and CDSA consider it a fatal error, which for the HTTPS handler means the response is completely discarded. That's what's happening here with Yahoo: their HTTPS server closes the connection without sending close_notify first.

The danger of not checking for that alert is that any MitM may cause a response to be truncated, yet we'd be unable to tell that it is.

Is it really an error condition libpurple should consider fatal? I'm not entirely sure.

closed as off-topic by schroeder, Xander, TildalWave, Graham Hill, Rory Alsop Jul 24 '14 at 9:42

This question appears to be off-topic. The users who voted to close gave this specific reason:

  • "This question does not appear to be about Information security within the scope defined in the help center." – schroeder, Xander, TildalWave, Graham Hill, Rory Alsop
If this question can be reworded to fit the rules in the help center, please edit the question.

1

To make a SSL implementation not complain about the lack of close_notify, the direct method is to download the source code, modify it, then recompile it. This may imply a substantial amount of work. If your OS is some Linux flavour, then the package manager may provide a way to obtain a source tree already configured for proper integration with your system (with apt-get source on Debian-like distributions).

Alternatively, you might try to fiddle with iptables so as to block the "FIN" flag from Yahoo -- thus emulating an absence of connection closure, which would then explain the lack of close_notify; from the point of view of the client, things would remain open. If the HTTP response include a Content-Length header, or use chunked transfer encoding, then this as a good chance of working. Notably, the lack of close_notify is a security issue only for protocols which rely on connection closure to convey semantic information, e.g. HTTP 0.9, but not "modern" HTTP.

If that's a one shot, you may find it simpler to temporarily use another browser which would be less picky about the close_notify when doing HTTP (and that would not be really wrong, as long as the HTTP response are self-terminated). Try chromium.

  • can you tell me the iptables command please? i'll assign it to my router so it doesn't complain across all my devices. also using chromium didn't solve the problem. – H3lp3ingth3p33ps Jul 23 '14 at 11:48

Not the answer you're looking for? Browse other questions tagged or ask your own question.