3

According to my experience surfing the web, many websites foo.com don't support https. When I go to https://foo.com, it just changes to foo.com

Can attackers forge the fact that foo.com doesn't support https and use http instead?

Improve this question
2
  • 1
    If it doesn't support https, why would you need to forge this? A MiTM can however forge http traffic from a https connection. Keep an eye on that padlock! – BadSkillz Aug 6 '15 at 14:44
  • @BadSkillz - you misunderstood the question (and so did I). Check out my answer for clarification. – TTT Aug 6 '15 at 19:54
10

Contrary to the intuition, fact that https://foo.com changes to http://foo.com in modern browser means foo.com does support https, and whoever is issuing the redirect has certificate for foo.com (and not any certificate, one that your browser trusts). Otherwise server at foo.com wouldn't be able to instruct your browser to redirect, because redirect command (Location: http://foo.com in combination with proper status code) is part of http protocol, which browser does not start to speak to the server in until the SSL handshake completed successfully.

Improve this answer
3

My Old Answer:

If a site is not using https, it's already "sniffable", so it doesn't matter that it redirects from https to http. There's nothing additional to take advantage of, since it's already http.

Instead, if a site is purely https, that's where the MITM attack could take advantage of changing the protocol to http. This is certainly possible, and this is why when you are visiting a site that requests or displays personal information, you should check to make sure that the site is using https with a valid cert. If it's not, it's possible there is a MITM happening and your traffic is being compromised.

Edit: I'm sitting here racking my brains trying to figure out how my response could possibly be down-voted. But now I realize that I misunderstood the question. (And so did Badskillz judging from his comment.) I thought the question was something like: "Can attackers force a redirect to http on a site that only has http (or redirects from https to http)?" When in fact, it appears the question is asking, is it possible that foo.com is actually supposed to be using https, but an active MITM attack is redirecting it to http? The answer is Yes, it is possible for a MITM attack to do that. Of course, it's much more likely that somewhere on foo.com there are pages that use https, and those pages are forced to use https, and the rest of the site is forced to use http- thus the redirect. If you're on your banking site and you see a redirect to http, I'd be much more likely to start thinking that could due to a MITM attack.

I'm leaving my previous answer because it is still accurate information.

Improve this answer
1
  • My bad, I should have explained my down vote. The main reason was this statement: "Instead, if a site is purely https, that's where the MITM attack could take advantage of changing the protocol to http." That is not true at all. It would completely invalidate https if a casual attacker could just redirect any https site to http. But the point about answering a different question is true as well. The new answer is much better. P.S. No, the irony is not lost on me: Anonymous down vote. – Anonymous Aug 7 '15 at 0:43
0

No, nothing is wrong with that.

Lot of websites function that way because they know their visitors forget easily to write https:// since they do not even know all of them the difference between HTTP and HTTPS. That is the only purpose of the behavior you described: in order not to loose their audience, lot of websites choose to behave like that.

Apache server is the most widespread as this study from Netcraft mentions:

enter image description here

Based on this, we can mention one of the most common methods used in Apache to have the result you described by taking advantage of its mod_rewrite used to rewrite the rules requested URLs which, if enabled, allows to achieve that goal by adding httpd.conf file these lines:

RewriteEngine On
RewriteCond %{HTTPS} off
RewriteRule (.*) https://%{HTTP_HOST}%{REQUEST_URI}
Improve this answer
2
  • 2
    You may want to re-read the question: "When I go to foo.com, it just changes to foo.com" – Anonymous Aug 6 '15 at 19:00
  • Yes, I read it again. @Anonymous – user45139 Aug 6 '15 at 19:54
-1

Yes, they can. When they see an attempt to make a TLS connection to a server, they can intercept it and reply with a fake error message stating that the server does not support TLS. This technique is known as SSL stripping.

Improve this answer
1
  • 4
    SSL stripping is the fact of s/https/http/g on HTTP traffic to prevent the redirection and keep the traffic in clear, nothing happens on a TLS connection attempt. – r00t Aug 6 '15 at 15:09

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.