An active attacker who positioned to alter your network traffic can do anything your ISP can do to your HTTP traffic. In that sense, one MITM (your ISP) injecting content into a page isn't going to alter the ability of another MTIM (an attacker) to read or write your traffic.
However, the main concern seems to be with passive attacks that are minigated by the service by client-side mechanisms. From your first article:
Even if Comcast doesn't have any malicious intent, and even if hackers don't access the JavaScript, the interaction of the JavaScript with websites could "create" security vulnerabilities in websites, Schoen said. "Their code, or the interaction of code with other things, could potentially create new security vulnerabilities in sites that didn't have them," Schoen said in a telephone interview.
As a trivial example, suppose a site consumes JSON supplied as a URL parameter like http://example.com/show?json={"foo":5,...}
. The site uses the JavaScript function JSON.parse
to parse the JSON. Meanwhile, a thoughtless developer at the ISP has included the line JSON.parse = function(e){return eval("("+e+")")};
in their MITM script (because JSON.parse
isn't supported in older browsers, and its behavior is basically a subset of eval
anyway).
This would obviously allow an attacker to send you a link like http://example.com/show?json=sendToBadGuys(document.cookie)
to potentially disastrous result. The attacker doesn't need to be in a position to intercept your traffic; the attacker only needs to be in a position to get you to click on a link. The site was given a new security vulnerability by your ISP.
Of course, no one is foolish enough to completely overwrite JSON.parse
with eval
(or, that's the dream, anyway), but this example demonstrates that a MITM's ability to muck around with the JavaScript environment is clearly a dangerous thing, even when well-intentioned.
Also, as a completely separate concern, any information the well-intentioned MITM includes could be read by a malicious MITM. For example, if your hotel banner adds personal information like a "Time remaining for John Smith in Room 123: ten minutes" to all your HTTP web pages, that's obviously a concern as well.