News for hackers. Stuff that matters.

A comment on Cryptic Rumblings Ahead of First 2020 Patch Tuesday. Parent comment

Re:Cryptic Rumblings Ahead of First 2020 Patch Tuesday by atxlurker on Monday January 13, 2020 @11:30PM (#22041861)
I don’t think this is ultimately the vulnerability, but even without SNI, it’s arbitrary to dynamically link to a file, script, png, etc... hosted on a sub domain with the bad cert.
[ Parent | on HN ]
Re:Cryptic Rumblings Ahead of First 2020 Patch Tuesday by cjbprime on Tuesday January 14, 2020 @01:06AM (#22042270)
Oh yeah! So it's like:

* client asks for cert

* you give it to them

* client tells you the page they want and their useragent

* if you think they're vulnerable based on what you've learned about them, you add <img src="https://vulnerable.subdomain/"> to the response.

Neat suggestion. Thanks! Agree we've moved well outside of tomorrow's likely actual vuln.

[ Parent | on HN ]