News for hackers. Stuff that matters.

A comment on Cryptic Rumblings Ahead of First 2020 Patch Tuesday. Parent comment

Re:Cryptic Rumblings Ahead of First 2020 Patch Tuesday by tialaramex on Monday January 13, 2020 @10:34PM (#22041597)
I meant on unaffected platforms, say, Firefox on Linux. It'd be weird if I came to, say, Hacker News and now it had this untrusted cert (which is actually a worm attacking Windows PCs) instead of a normal one.

I agree that on an affected platform all bets are off, but deploying to a web server means you don't easily get to pick who your visitors are.

[ Parent | on HN ]
Re:Cryptic Rumblings Ahead of First 2020 Patch Tuesday by ikeboy on Tuesday January 14, 2020 @12:15AM (#22042054)
Just load a hidden image from a subdomain, silently fails if on an unaffected platform.
[ Parent | on HN ]
Re:Cryptic Rumblings Ahead of First 2020 Patch Tuesday by Thorrez on Tuesday January 14, 2020 @01:19AM (#22042327)
And you could also avoid even creating the iframe if the User Agent isn't Windows.
[ Parent | on HN ]
Re:Cryptic Rumblings Ahead of First 2020 Patch Tuesday by cjbprime on Monday January 13, 2020 @10:39PM (#22041621)
Oh yes, that's true. (Though now I wonder if cert negotiation can be dependent on useragent under SNI. It could certainly be dependent on TCP fingerprint characteristics.)

Agree with you that codesigning certs are a more likely problem space for this bug.

[ Parent | on HN ]
Re:Cryptic Rumblings Ahead of First 2020 Patch Tuesday by atxlurker on Monday January 13, 2020 @11:30PM (#22041861)
I don’t think this is ultimately the vulnerability, but even without SNI, it’s arbitrary to dynamically link to a file, script, png, etc... hosted on a sub domain with the bad cert.
[ Parent | on HN ]
Re:Cryptic Rumblings Ahead of First 2020 Patch Tuesday by cjbprime on Tuesday January 14, 2020 @01:06AM (#22042270)
Oh yeah! So it's like:

* client asks for cert

* you give it to them

* client tells you the page they want and their useragent

* if you think they're vulnerable based on what you've learned about them, you add <img src="https://vulnerable.subdomain/"> to the response.

Neat suggestion. Thanks! Agree we've moved well outside of tomorrow's likely actual vuln.

[ Parent | on HN ]