Re: HSTS preload flaw

On Sun, Feb 9, 2020 at 10:28 PM Austin William Wright <aaa@bzfx.net> wrote:

>
> It seems to me if an attacker can get a victim to compose a sensitive
> request, but direct that request to an attacker-controlled scheme and port,
> why not an attacker-controlled host too, or any host not on an HSTS Preload
> list?
>

That's a fair question. Intercepting a single unencrypted innocuous request
is a viable way to get the victim to compose requests to
attacker-controlled servers over TLS. These hosts might not be legitimate,
but users won't always notice a discrepancy in domain names. Here is a toy
attack:

Serve a search engine UI, but pop up an "Accept Cookies" UI that is
seemingly intended to comply with privacy regulations. In response to a
click on any choice presented, redirect to an attack-controlled domain
(that might be served over TLS, with a misleading domain name).

thanks,
Rob