2.1k VIEWS
Pinterest LinkedIn LINE

The WPAD/PAC Attack presented on August 3 at Black Hat 2016, which can read HTTPS URLs,1 is an attack that makes you think, “Ah, I see.”

 Instead of attacking HTTPS itself, the technique uses a PAC file during proxy resolution for the HTTPS host to filter the contents of the URL and send them to the attacker’s host.
 
Some browsers perform proxy resolution every time (for example, Firefox and Chrome), while others do not. The attack is not very successful against the latter, but it is effective against Firefox, Chrome, and similar browsers. However, “Automatically detect settings” must be enabled in the LAN proxy settings. This option may be enabled fairly often in corporate systems and similar environments.
 
Incidentally, the slides contain the following:
 
  • OpenID authentication URLPassword reset URL
But perhaps this is a mistake, and it should be:
  • OpenID authentication
  • URLPassword reset URL
There is no such thing as an OpenID authentication URLPassword reset URL.
 
Both the query in the OAuth authorization request and the query in the response can be stolen. In other words, if response_type=code *, the code is stolen; if response_type=token *, the token is stolen, and it is sent to the attacker’s server in real time.
Of course, users are safe if they disable the automatic proxy-configuration option mentioned above, but there is little the OAuth Server/Client can do about that. Available countermeasures include:
  • If S256 PKCE[RFC7636] is used, the code cannot be put to use, so it is safe.
  • Using Form Post mode is also safe.
  • Naturally, using Token Binding is also safe.
That is about it.
Password Reset URLs are vulnerable. In fact, this is the more serious problem. URL-based file sharing on services such as Dropbox is also vulnerable. One possible server-side countermeasure would be to require users to enter the file identifier separately in a form, but the troubling part is that this would probably make the service unusable for many people.
 

Footnotes

  1. Kotler, I., Klein, A.: Crippling HTTPS with unholy PAC, https://www.blackhat.com/docs/us-16/materials/us-16-Kotler-Crippling-HTTPS-With-Unholy-PAC.pdf

Related posts