Newly discovered HTTPS flaw can expose supposedly secure URLs to wireless evesdropping

By Justin Pot July 26, 2016

https vulnerability public wifi leak urls internet coffee shop — Image used with permission by copyright holder

When you use HTTPS, the addresses you visit are supposed to be encrypted, regardless of what network you’re connected to. A newly discovered vulnerability proves that’s not necessarily true.

If you’re connected to an insecure wireless network, especially one that isn’t vouched for, HTTPS alone won’t protect you, security researchers Itzik Kotler and Amit Klein said this week in a talk at the Black Hat security conference in Las Vegas. With the right configuration, a malicious network could discover every supposedly protected URL you visited.

“We will demonstrate that, by forcing your browser/system to use a malicious PAC (Proxy AutoConfiguration) resource, it is possible to leak HTTPS URLs,” says the talk’s description.

The vulnerability potentially affects Windows, Linux, and Mac computers regardless of browser: IE, Safari, and Chrome. But don’t panic about this affecting you at home, or at work. If you connect to a secure network, this doesn’t affect you. Instead, it’s something owners of supposedly free Wi-Fi networks could set up as part of a phishing operation.

It’s worth noting that the content of the sites you visit is not revealed by this vulnerability. But many sites put vital information, including usernames and even passwords, into URLs over HTTPS. It’s a bad security practice, but some developers assume that HTTPS protects information in such cases.

In other cases, even sharing the URLs you visit is too much information to give potential hackers.

The only way to truly be safe from exploits like this is to not connect to networks you cannot vouch for. If you’re in a coffee shop, verify that it offers Wi-Fi, and the network’s name, before connecting.

And even if an unsecured network is vouched for, assume that your information still might not be secure, even if you’re using HTTPS. Check out our guide to browsing the web privately, then set up a VPN or Tor to browse anonymously even on public networks. Even then, avoiding untrusted networks is probably the best bet.

Exploits like this prove that public Wi-Fi networks aren’t without risk, so take the time to inform yourself. It’s worth it.

Editors' Recommendations

Topics

Former Digital Trends Contributor

Justin's always had a passion for trying out new software, asking questions, and explaining things – tech journalism is the…

Computing

Security flaws in 4G and 5G networks could expose your phone calls and location

A cell phone tower.

A group of academics from the University of Iowa has discovered three flaws in both 4G and 5G networks which could allow attackers to intercept phone calls and track the location of smartphones. Published in a report picked up by TechCrunch, this is believed to be the first major vulnerability in 4G and 5G networks identified in recent times.

The first of the flaws open up the possibility for an attack known as "Torpedo." This takes advantage of a protocol that is used by major cellular networks whenever a phone is pinged before a call or text message is sent to it. According to the report, placing several phone calls and canceling them over a short a short period can lead to a paging message that can be exploited to track back the location of a smartphone. This also could allow an attacker to, in turn, leverage the paging channel and generate fake messages or block SMS messages altogether.

Computing

Despite serious security flaws, D-Link will (again) not patch some routers

modem vs router plugging in

For the second time in roughly a year, D-Link has failed to act on warnings from security researchers involving the company's routers. The latest incident arose after Silesian University of Technology researcher Błazej Adamczyk contacted D-Link last May about three vulnerabilities affecting eight router models. Following the warning, D-Link patched two of the affected routers, but did not initially reveal how it would proceed for the remaining six models. After further prompting from Adamczyk, D-Link revealed that the remaining six routers would not get a security patch because they were considered end-of-life models, leaving affected owners out in the cold.

"The D-Link models affected are the DWR-116, DWR-140L, DWR-512, DWR-640L, DWR-712, DWR-912, DWR-921, and DWR-111, six of which date from 2013, with the DIR-640L first appearing in 2012 and the DWR-111 in 2014," Naked Security reported. Though these are not current models in D-Link's portfolio, many of the listed models are still likely to be in use.

Computing

MSI could be prepping next-gen OLED gaming monitors — and they look insane

Marvel's Spider-Man running on the Samsung Odyssey OLED G8.

MSI is getting serious in the gaming monitor space. Newly leaked information suggests that the company is preparing at least six new QD-OLED monitors that are set to arrive in the coming months. It is said that the new models will range from 27 inches to 49 inches in size, with refresh rates of up to 360Hz.

The alleged information comes from Twitter/X user @chi11eddog, who is known for consistent and reliable leaks, particularly regarding MSI and general hardware-related information. The upcoming monitors are expected to be part of MSI’s MPG and MAG series of product lines, with the first new model scheduled for November 2023.