Of course, if you are already logged into a Google account for that browser session, it is served encrypted.

So when a user visits unencrypted Google News page, and taking into account there is a Google login button on the page, are users vulnerable to a SSLStrip MITM attack if they choose to login from that page?

  • just use the secured page – Skaperen Sep 7 '15 at 9:31
  • This isn't me asking for advice on what to do... – Breakhty Sep 7 '15 at 10:33

are users vulnerable to a SSLStrip MITM attack if they choose to login from that page?

Yes and no. Users are no more or less vulnerable than they are from clicking on a link in any unsecured page.

All Google logins are processed through accounts.google.com, which not only has HSTS turned on, but also has its public key pinned in modern browsers. So a MITM on the login page is not practical.

That said, the attacker wouldn't use accounts.google.com as their phishing domain, they'd use some hacked wordpress site somewhere if history is any indication. So the security of the login page itself can't save everyone.

And in fact the security of news.google.com isn't particularly relevant either if the user isn't explicitly adding HTTPS to the front; as long as that domain doesn't have HSTS enabled, SSLStrip can work its dirty magic.

And that's kind-of an important distinction: the fact that your site is HTTPS doesn't protect your users against SSLStrip; the whole point of SSLStrip is to demonstrate that serving your site over HTTPS doesn't help users who get to that site from an unsecured link.

HSTS protects users who type your site name into their browser, but even that doesn't protect everyone. Take Facebook, for example, which is SSL and HSTS through-and-through. You might say Facebook's users are therefore protected, but a phishing site isn't going to use facebook.com as its URL; it'll use the URL of whatever site the attacker hijacked in order to host his attack. Certainly the discrepancy is visible to anyone who checks the URL, but statistically very few people ever do.

So yes, users are vulnerable. Users will always be vulnerable. If you're going to dump money into a solution to protect your users, do this:

  1. Make the login page HSTS (as Google and Facebook both do) and
  2. Get visitors to use browser-integrated authentication.

That could be saved passwords, lastpass, Google's U2F device, or any authentication system which will refuse to attempt authentication if the browser has not verified the authenticity of the login page.

If you do those 2 things, users are absolutely protected.

  • Ok, awesome answer. So the only thing extra special in this case, is that users are ripe for the phishing, connecting to a legitimate unencrypted Google service, and will trust the login button without pause, making a [MITM > login redirect phish] attack more effective to Google users. Yes? – Breakhty Sep 7 '15 at 10:44
  • Sending users to a phishing page by MITMing an unsecured page is an uncommon attack scenario. Usually you get there from an outright malicious or compromised page (or more likely, email). It's better to protect the login process than try to protect all the links to it. – tylerl Sep 7 '15 at 16:14
  • Ok, as unlikely as it is, as far as phishing goes, a MITM of news.google.com login link, is far more effective than trying to get people to land on a login page from out of the blue. – Breakhty Sep 8 '15 at 2:07
  • "Far more effective" probably overstates it a bit. It'd be like an intruder breaking in to your apartment in order to reset your WiFi password. As effective an attack as that would be, you'd expect an attacker who gains that level of access to do something far more damaging with it. – tylerl Sep 8 '15 at 7:00

The site http://news.google.com is delivered through http. The actual login page behind the button is:

<a class="gb_7c gb_ya gb_xa" id="gb_70" href="https://www.google.com/accounts/ServiceLogin?service=news&amp;passive=1209600&amp;continue=http://news.google.com/&amp;followup=http://news.google.com/&amp;hl=en" target="_top">Sign in</a>

But the SSLstrip attack would not exactly be working. Just replacing https with http does not make Google deliver the login page unencrypted. If you try this you actually get the https version like explained by jas-. Google can enforce the usage of TLS for any of their websites and they surely do for the login page.

You may be right that a MITM would be possible for the news site itself when accessed directly through http://news.google.com, but that is not the default behaviour. Actually Google delivers the site through https by default when navigating the website and as Google's main-page is also delivered through https, this means you should be save against SSLstrip and MITM, in that context (without taking attacks against TLS into account).

What might be critical if your browser does not support current TLS versions. In this case some parts websites might be delivered through http as fallback mode, but I am not certain if that is the case for Google. It certainly does not happen for the login page.

In that case or when using http://news.google.com you might be able to craft a scenario where you could use MITM but not SSLstrip. So an attacker could alter the news, but would not be able to see your credentials.

If no settings were changed deliberately you should be save.

  • But a MITM could alter and redirect the login link to a phishing site with a fake login page though? – Breakhty Sep 7 '15 at 11:20
  • Yes exactly. Just like you wrote in the comment to tylerl's answer. – John Sep 7 '15 at 11:59

Well, in theory, there's no need for HTTPS for browsing that type of material...however, I'm pretty sure Google made HTTPS active for all browsing, even non-sensitive stuff.

To clarify, if you just go to www.google.com it is indeed HTTPS.

  • I don't think that in todays age, the need for https depends on the material. And as you say, Google (one of the big pushers for https-everywhere) has it enabled everywhere. Except for news.google.com! That's why it is interesting and I believe exposes Google users to the risk of a MITM phishing attack. – Breakhty Sep 7 '15 at 11:48

are users vulnerable to a SSLStrip MITM attack if they choose to login from that page?

No. If you begin recording and/or watching the network page requests you will see that news.google.com will check for and authentication token referenced by a cookie for the https enabled version of their site which it cannot find because the stateless protocol's ability to read/modify another domains cookie data (in this case https://news.google.com vs. http://news.google.com) adheres to the same-origin policies security restrictions.

At which point a request is made for the authentication page over TLS.

  • Why couldn't a MITM alter the Login button link to another site with a fake Google login page? What, according to you, would prevent this when on unencrypted news.google.com... There are lots of external links on the page, what is different about the login link, that couldn't be changed? – Breakhty Sep 7 '15 at 11:22

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.