News for hackers. Stuff that matters.

A comment on LeakyX, a vulnerability that Apple and Microsoft have known about for years. Parent comment

Re:LeakyX, a vulnerability that Apple and Microsoft have kno... by jlgaddis on Saturday September 23, 2017 @05:22PM (#15321805)
A valid certificate with a hostname matching the server's?

In this case, it's POST'ing the credentials before the certificate is validated.

[ Parent | on HN ]
Re:LeakyX, a vulnerability that Apple and Microsoft have kno... by dogma1138 on Saturday September 23, 2017 @06:09PM (#15322050)
Again this isn't the case, I've tested it out myself and I get a prompt to confirm the SSL certificate when an invalid certificate is used.

This is the step that the author gracefully has omitted: https://imgur.com/a/OXIal, and no nothing is sent until you approve the certificate.

I can't be bothered to set up an actual exchange server to check what happens if you change the certificate midway, however having to approve a certificate change before when the certificates were rotated at my previous employer at least twice on an iPhone (and much older than the current iOS) it would bet that nothing is being sent.

[ Parent | on HN ]