HTTPS was considered immune to hackers looking to track the websites visited by a user. A new hack breaks this HTTPS protection in Windows, Linux, and Mac systems. The hack can be carried by Wi-Fi hotspot operators, Ars Technica reports.
HTTPS encryption assured users that the addresses of the websites they visit could not be monitored or viewed by data snoopers and other such malicious users. However, a new hack has broken this encryption. This hack can be carried out on any network, most notably in Wi-Fi hotspots, where this encryption is most required.
This hack is possible by illicit usage of a feature called WPAD, which is short for Web Proxy Autodiscovery. Doing so will expose some browser requests to the code controlled by the attacker. The attacker can then view all the websites user visits. It is said that this exploit works in all browsers on every operating system. This HTTPS hack is scheduled to be unveiled in a Black Hast security conference in Las Vegas next week.
The enormity of this attack is still discussed. Although this attack only makes the full URL of visited websites available to the hacker, the consequences of that are too grave. This is because many websites and web services use URL to authenticate a user. For example, Google’s Dropbox uses a security token in the URL. Even some password-reset mechanisms use this token security technique. So despite the attacker gaining access only to the full URL, he or she can misuse that to great effect.
Source: http://www.valuewalk.com/2016/07/https-bypassed-windows-mac-linux/
Submitted by: Arnfried Walbrecht
Comments are closed.