kttaon Hacker News • Recommends
On “Broadening HSTS to secure more of the Web”
Relevant part starts here link to this video Although for anyone interested in HTTPS, I'd recommend watching the whole thing. Very entertaining.
0:00 / 0:00
#sslstrip#moxiemarlinspike#hsts
Defeating Ssl Using Sslstrip (Marlinspike Blackhat)
TheSecurityTube
39K subscribers • 1 video on Hallway
- Recommended by 3 people: 3 on Hacker News.
- Presented by Moxie Marlinspike, security researcher
- May be out of date. Uploaded 14 years ago, in an area where tools change fast.
Intermediate. Assumes working knowledge.
61K views14 years ago3 recommendations
SecurityWeb developmentWeb and application securityExploits and vulnerabilitiesCryptography
Moxie Marlinspike demonstrates sslstrip at Black Hat, showing how to hijack HTTP-to-HTTPS redirects to transparently strip SSL/TLS encryption.
Full Video Details: securitytube.net/video/157Why it's here
3 people recommend thisWhat people say. Recommended as a classic, highly entertaining security talk that explains the vulnerability that motivated HSTS.
fabuliston Hacker News • Recommends
On “How to Learn Hacking”
This guide is very hand-wavey. Tor alone is a poor operational security strategy; using nikto and unix-privesc-check does not a hacker make. This may be a decent place to begin one's inquiry, but don't let it end here too. Here are some talks I recommend: Tricks for Defeating SSL in Practice - Moxie Marlinspike link to this video OPSEC: Because Jail is for wuftpd - thegrugq link
superuser2on Hacker News • Recommends
On “Our First Certificate Is Now Live”
We don't have humans in the loop for issuing certificate; this can and has been exploited for fun and profit, with fun attacks like getting a cert for "citibank.com\0.mydomain.com" which used to trick the C strcmp in most browser certificate checking routines. Moxie has an entertaining talk: link to this video Your problem would be getting people to "thecitibank.com." Chrome, Firefox, and GMail would all eventually figure out it was a phishing site and warn users about clicking through to it.
sammanon Hacker News • Mentions
On “Why public WiFi is dangerous”
Perhaps one of the techniques discussed here: link to this video ? Or, as this was published a couple of days ago, it might have utilized POODLE, or even BEAST in unmitigated cases. But yeah, I'd also believe user error in some cases.
sgentleon Hacker News • Mentions
On “Here’s to more HTTPS on the web”
If it helps, the attack you're describing is called sslstrip and was presented by Moxie Marlinspike at Black Hat in 2009: link to this video (code here: link ) As others have mentioned, the current best defence against this is HSTS (and, in particular, HSTS preloading). I think the best explanation of it is here: link
schoenon Hacker News • Mentions
On “Broadening HSTS to secure more of the Web”
> How viable is the interception a http-to-https redirect page? It can be very powerful if done maliciously: link to this video (This kind of attack is a primary motivation for the existence of HSTS.)
CydeWeyson Hacker News • Mentions
On “Alibaba’s UC Browser is dominating in Asian markets with lower-end smartphones”
History lesson incoming: link to this video The only effective way to get guaranteed security is with HSTS preloading. Anything short of that leaves you vulnerable to the linked attack, which dates way back to 2012.