New attack plucks secrets from HTTPS-protected pages

Re:New attack plucks secrets from HTTPS-protected pages by AnIrishDuck on Thursday August 01, 2013 @01:08PM (#6141752)

I think it's actually more limited than that ... they have to be able to modulate the response body through a request, which sounds really f'in difficult to do with a properly designed web application.

I'm pretty sure they need a server that responds to POST form requests with user-specified unchecked data from that form, in addition to secret data the attacker actually wants. And the more I think about it, the more I wonder how existing CSRF protections wouldn't block that already.

I really wish I could find more details on this attack; I like Ars Technica for general news but the technical details are lacking here.

[ Parent | on HN ]

Re:New attack plucks secrets from HTTPS-protected pages by samwillis on Thursday August 01, 2013 @01:17PM (#6141836)

Most forms maintain the data that was entered by the user when there is a validation error. Say the attacker is after csrf token they could just use one of the fields in the form for entering their guess and it will be included in the responce.

[ Parent | on HN ]

Re:New attack plucks secrets from HTTPS-protected pages by StavrosK on Thursday August 01, 2013 @01:53PM (#6142085)

You could do this more easily if the page included data from the GET query, something like a name or a search query or something like that, which gets echoed in the response.

[ Parent | on HN ]