Hacker News

points by paaloeye 1 day ago | 0 comments

> Anyone can intercept any HTTPS connection these tools make.

yeah, it's not ideal but the scale of the threat is way overblown tbh. You have to compromise a lot to be able to make a MITM here.

Let's not treat it like PHP2Shell.

[–] dspillett 1 day ago

Don't underplay it either though: with a compromised but unrevoked signing cert all it takes is a successful phish, or some problem to allow DNS poisoning (or hack a wireless AP, or …) to direct you to a fake site or (potentially worse as it might be less immediately noticeable and could quietly collect credentials/data for a while) send your automated tools to a malicious API.

It may not be directly exploitable on its own, which is the impression some reports give, but it is a serious hole to leave open especially with the current rate of old security issues being found, as it could be _incredibly_ useful to a malicious actor as part of an exploit chain.

[–] jfyi 1 day ago

Yeah, it increases the attack surface of mitm attacks to your network from the local os level.

[–] commandersaki 1 day ago

Doesn't affect app bundles though, only *nix commands. This'd be detected pretty quickly, at least by the significant portion of patched devices.

[–] dannyw 1 day ago

Unless you're clever enough to only poison user agents known to be macOS and CLI. You'd probably get by.

xz-tools was only caught because it had a bug causing slow startups and someone was micro-benchmarking Postgres and decided to dive in further.

[–] genxy 1 day ago

One person, at that particular time. The person and the task were also a couple standard deviations away from the norm, the world was incredibly lucky.

[–] throwawaysoxjje 1 day ago

The cert is provided before the user-agent string is

[–] rekoil 1 day ago

It's pretty easy to compromise things like McDonalds or Starbucks WiFi hotspots though, just setup a Pineapple with the right SSIDs and a 5G modem, funnel your target domains through your mitmproxy via the DHCP DNS server you're providing, and that's basically it.

I agree it's not PHP2Shell, but its certainly not being "way overblown" here.

[–] 1718627440 1 day ago

Why would these public network would allow guest hosts to communicate with each other?

[–] HiJon89 1 day ago

I think they're saying you create your own malicious wifi network and people will unintentionally connect to it. This network specifies your malicious DNS server via DHCP, and everything looks secure to the client. I think the main issue with this in practice is that all the major browsers have been updated to not trust these certs.

[–] rekoil 1 day ago

So you target some host like ssh.dev.azure.com, find all the hooks in the proper repo the client is trying to access, make a new commit that puts your persistence payload in one of them that you expect will be executed soon, this script can additionally "correct" the git state when it finally runs, and moves its persistence to some more appropriate location.

Users will be none-the-wiser because they're not accessing these hosts through a web browser, and you net a few more compromised hosts in your inventory.

[–] commandersaki 1 day ago

Yeah also got to be lucky that the users are using https and not ssh. You're very limited in what you can mitm, you'll be trivially detected by patched devices (though maybe not acted on because nobody is the wiser), but then you'll need to serve objects with common/conflicting hashes -- fixing up that state synchronisation (what you call "correct") to then do nefarious things is not trivial at all. Extremely difficult to pull off successfully for git anyways or to do it in stealth.

[–] rekoil 1 day ago

Ahhh, true, SSH isn't the same certs, my bad... well, both Github and Azure DevOps default to HTTPS-based cloning anyway...

[–] ctippett 1 day ago

They wouldn't. A device like the Pineapple broadcasts its own copycat wireless signal and tricks unsuspecting clients to connect to it thinking it's the real one.

Edit: Holy moly we all jumped on this comment at the same time didn't we.

[–] jfyi 1 day ago

> Holy moly we all jumped on this comment at the same time didn't we.

It's good to see push back against this narrative that is trying to develop that this isn't any kind of big deal.

This has been every machine on the internet compromised for at least 12 hours and probably some that are not going to ever get patched.

[–] rekoil 1 day ago

> probably some that are not going to ever get patched

This is a HUGE deal for embedded devices, we can now mitm HTTPS traffic on lots of embedded devices running Linux produced between 2018 and now.

[–] jon-wood 1 day ago

They don't need to, a Pineapple (or anything else that can run a wireless access point, you could do this with a laptop) just needs to advertise the expected SSID and do so with a stronger signal than the official ones for people's devices to connect to it instead of the actual network.

[–] jrmg 1 day ago

It’s extremely common to see other Macs pop up in the ‘network’ panel in Finder in the independent coffee shops around me. I imagine they’re just signing up for a business plan and using the routers the ISP gives them with a custom SSID and password.

[–] SXX 1 day ago

You dont interact with anyone. You just set your own hotspot and people will connect to it.

[–] breakwaterlabs 1 day ago

The near-universal use of TLS and the absurd ceremony we go through to ship root CAs everywhere is all premised on the idea that MITMs are not terribly difficult.

The entire reason one can rest easy as they connect to their coffee shop's WPA2-PSK network, is the security provided by TLS.

And if you don't think an ISP or agency would abuse this if it could be done undetectably then you haven't been paying attention these last 20 years (hence why DoH is now a thing).

[–] yonatan8070 1 day ago

Even a simple rouge AP is enough to become a MITM for this.

[–] itintheory 1 day ago

Why is the color of the access point relevant?

[–] yonatan8070 1 day ago

TIL rouge means red in French

Either way, I mean rouge in the sense of an AP that uses the same SSID and password as the AP of a coffee shop or office to have devices automatically connect to it without their users noticing.

[–] ButlerianJihad 1 day ago

In English, rouge is a type of makeup.

“Rogue” is a completely different word. Rogue access point.

[–] yonatan8070 1 day ago

My apologies. Thanks for the correction

[–] zdp7 1 day ago

Da Red goez fasta. Hence the router beats the non red router to the punch.

[–] chpatrick 1 day ago

You can take your laptop to a busy place, make a "free wifi" hotspot that runs everything through mitmproxy and you can steal everything.

[–] itintheory 1 day ago

I think "everything" is an overstatement. Browsers included the compromised intermediates in their CRLs within hours of disclosure.

So this isn't like Firesheep [0]. Yes, there would be vulnerable traffic, like the git client this thread is discusing, but it's not "everything"

[0] https://en.wikipedia.org/wiki/Firesheep

[–] alt227 1 day ago

If you see a developer using git on a Mac laptop in a coffeeshop, you can intercept that and gain their repo and probably password hashes pretty easily.

[–] chjj 1 day ago

> You have to compromise a lot to be able to make a MITM here.

This is just an argument against TLS in general. Use plain http if you believe this.

[–] caaqil 1 day ago

Appealing to complexity is always fun. Just throwing "a lot" in there for good measure and you won't have to think about practical security implications.

[–] tensegrist 1 day ago

php2shell was overblown perhaps but this is being blown quite correctly

[–] abujazar 1 day ago

The TLS trust chain is the last defense against MITM attacks. The prevalence of MITM attacks is in fact the very reason TLS exists. I'd say it's a lot worse than PHP2Shell because it doesn't only affect poorly maintained servers, but potentially ALL credentials and secrets a user sends over a compromised network with compromised CAs on their device.

[–] commandersaki 1 day ago

The window of opportunity to MITM has passed. If you attempted an MITM from an easy vantage such as telco, ISP, or public wifi you'd be trivially detected as a significant portion of devices are patched, including on these unpatched macs as only the *nix commands are affected and not app bundles.

[–] acdha 1 day ago

You might be detected but if, for example, you were smart enough not to MITM the same client twice after an error, I suspect a ton of people would ignore it and just assume the airport/coffee shop WiFi was flaky.

I’d also bet more things use libcurl behind the scenes than we appreciate, and that at least a few of them have things like silent updates which retry after a failure without notifying a user. I’ve seen a lot of agents which just try to periodically check in because they’re designed not to be noisy on lousy networks.

[–] catlifeonmars 1 day ago

This is way worse than PHP2Shell in scope of impact and its effects will stick around for much longer. Well, as long as the validity period of the compromised certs anyway

[–] educar 1 day ago

If you hijack the DNS, the laptop can be pwned quite easily. Think of all the coffee shops with unprotected routers out there.

[–] yonatan8070 1 day ago

Exactly, I've been to public places where the Wi-Fi password is on the wall and the router's admin password is "admin".

[–] mschuster91 1 day ago

> You have to compromise a lot to be able to make a MITM here.

It's trivially easy to mount an ARP spoofing attack. I did that at school two decades ago and on-the-fly rewrote <img src=...> to hardcore porn images for funsies.

mitmproxy [1], a popular toolkit for making that easy, has the option to generate "eMudhra" certificates on the fly now.

It is trivially easy to compromise things, all you need is physical access to the network.

[1] https://news.ycombinator.com/item?id=50189232

[–] sersi 1 day ago

I don't know why you're downvoted, any public wifi access point in a shop could be compromised and users would never notice.

[–] treesknees 1 day ago

Client isolation is very common on wireless and wired LANs these days in enterprise and guest network environments. You also have tools like dynamic arp inspection to block poisoning attempts via the network switch.

If you get past all of that, you still need a victim who is actively using a cli tool on macOS using https.

It’s not impossible, but the conditions are much more specific than those needed to inject porn into a webpage on a poorly configured school network in 2006.

[–] 9dev 1 day ago

…and yet it doesn't help at all if a laptop sees an AP with strong signal in its vicinity and connects to that instead of the meticulously configured AP that sits behind the counter with a slightly weaker signal.

[–] treesknees 1 day ago

You’re not actually making the point you think you are. This comes back to the original comment stating you need to compromise a lot to MITM here.

So you need to somehow trick macOS into remotely connecting to the wrong bssid, and then arp poison a user who happens to be using a macOS cli tool that’s using https.

Sounds pretty targeted and unlikely to happen.

[–] 9dev 1 day ago

Go to a random coffee shop that allows people to work at the tables, and you’ll find a few developers with MacBooks there pretty soon. They will be connected to the local hotspot, which either has no password at all, or WPA2 with the password written on a billboard behind the counter. Spin up an evil twin, then wait for the connections to roll in.

I don’t think that’s either targeted or unlikely?

[–] yonatan8070 1 day ago

Exactly, I do this all the time for doing out-of-office demos with our company's robots.

I just set up my phone's hotspot to be the same SSID and password as the network the robots already know from the office, and I'll have the robots, a couple phones, and a laptop connected in 10 seconds.

[–] raverbashing 1 day ago

> all you need is physical access to the network

Yeah that's not so much "trivially easy"

[–] breakwaterlabs 1 day ago

Do you have a cell phone? Do you use Wifi? Do you use an ISP who, in the last few decades, has performed any form of interception or traffic-tampering?

I hazard that the answer to all three of those is "yes".

[–] paaloeye 1 day ago

> all you need is physical access to the network.

yeah, it's trivial to punch somebody in the face in the morning, all you need to do is to be by their bad in the morning when they are waking up.

[–] cryptonym 1 day ago

You don't have physical access to the network, doesn't mean other actor aren't here. Working for providers, governments, or being able to impersonate them. This is a serious issue, it shouldn't be downplayed.

If you think it's not that important, it becomes a critic about TLS and basically saying that ciphers for web traffic are useless.

[–] mschuster91 1 day ago

Public wifi hotspots tend to give you that opportunity. Large commercial hotspots have inter-client communication blocked, but your average coffee shop style network? You're lucky if it even is an isolated VLAN from the shop's cash register lol.

[–] bawolff 1 day ago

Have you never used wifi at a coffee shop?

Physical access to networks isn't that hard to come by.

[–] ForHackernews 1 day ago

Great, you have an inconvenient way to possibly-maybe see some random's gmail inbox at Starbucks.

You'd be better off just mugging them in the parking lot.

[–] itintheory 1 day ago

> gmail inbox

Except it won't impact gmail unless you're accessing it through curl. The browsers already distrusted the compromised intermediates via CRL within hours of disclosure, and removed the affected root via update.

[–] jfyi 1 day ago

Sure practicality is always an issue. It's an issue that attackers will go to great lengths to resolve too.

What if it's the Starbucks at 1730 Pennsylvania Ave NW, Washington, DC 20006 for an extended period of time? Compounded with other security issues like password reuse...

We can always draw a line and say, "that's not practical". The assessment an attacker is likely to do is going to be "is this practical inside my budget for the value I hope to acquire?" or maybe even just "waow, lulz".

[–] alt227 1 day ago

No, you have a pretty easy way of intercepting someones git credentials and repo access. Arguably more dangerous than a gmail inbox.

[–] paaloeye 1 day ago

I have, but good luck predicting where I'm going to have my next cuppa. Outside of petty crimes mentioned, I don't see how it could be industrially weaponised to make actual damage.

Regardless, real bad actors are busy compromising your next `npm install` anyway. Much better reward.

[–] rolosa 1 day ago

Why would I care about you specifically, and not the dozens of other people working at the coffee shop? Does the world revolve around you?

[–] bawolff 1 day ago

If they are specificly targeting you, then they probably dont need to use the coffee shop. The coffee shop is for low skill attackers targeting people at random.

If someone has it in for you and hired a high skill attacker, its not a stretch to imagine they compromised your home network.

[–] voidUpdate 1 day ago

Compromising a specific person is difficult. Compromising any old person is trivial

[–] dahart 1 day ago

> good luck predicting where I’m going to have my next cuppa.

Why are you assuming there isn’t someone else trying to hack you at the next cafe? Actual damage can happen one person at a time, and can occasionally lead to larger scale compromises. Randomizing your location isn’t going to reduce your risk. Now that everyone who’s paying attention knows they can MITM your Mac, you shouldn’t trust any network.

[–] jon128 1 day ago

[flagged]