TE
科技回声
首页24小时热榜最新最佳问答展示工作
GitHubTwitter
首页

科技回声

基于 Next.js 构建的科技新闻平台,提供全球科技新闻和讨论内容。

GitHubTwitter

首页

首页最新最佳问答展示工作

资源链接

HackerNews API原版 HackerNewsNext.js

© 2025 科技回声. 版权所有。

LeakyX, a vulnerability that Apple and Microsoft have known about for years

69 点作者 Aaronn超过 7 年前

9 条评论

jlgaddis超过 7 年前
To be clear, the issue in &quot;Test A&quot; is the lack of certificate validation. It wasn&#x27;t immediately clear (poorly worded, IMO) but that&#x27;s the (only) issue I see in that scenario and that is, indeed, a security issue (allows a MITM attack).<p>&quot;Test B&quot;, however, is not a security issue at all, IMO; instead, it is &quot;working exactly as intended&quot;.<p>&gt; <i>The Apache logs are not even needed without SSL enabled because the first request to the web server includes the username and password in clear text.</i><p>If SSL isn&#x27;t enabled then, yes, of course it does. This may come as a shock to the author but standard IMAP4&#x2F;POP3 without SSL <i>also</i> sends credentials in the clear (as does -- <i>gasp!</i> -- every other plain-text protocol!)<p>&gt; <i>Even when SSL is not enabled the client should not be sending the credentials without first verifying that it is a real exchange server.</i><p>And just how would the client do that? Using an (easily spoofable) &quot;Server:&quot; header in the HTTP response?<p>&gt; <i>Realistically the client should not even send the password before verifying the user exists.</i><p>That, however, would be an information disclosure vulnerability (identifying valid usernames on the server). That&#x27;s why no other mail server in use on the Internet does that either. Not to mention that it&#x27;s real easy for a malicious attacker (in control of the server) to lie about that too.<p>Aside: if you&#x27;re running an Exchange server, set up Autodiscover [0] and all your users need to set up their mail account is their username and password (no server details are needed!). For other (i.e. non-Exchange) mail servers, there&#x27;s a similar &quot;Autoconfiguration&quot; method that is supported by various mail clients, such as Thunderbird [1].<p>[0]: <a href="https:&#x2F;&#x2F;msdn.microsoft.com&#x2F;en-us&#x2F;library&#x2F;office&#x2F;jj900169(v=exchg.150).aspx" rel="nofollow">https:&#x2F;&#x2F;msdn.microsoft.com&#x2F;en-us&#x2F;library&#x2F;office&#x2F;jj900169(v=e...</a><p>[1]: <a href="https:&#x2F;&#x2F;developer.mozilla.org&#x2F;en-US&#x2F;docs&#x2F;Mozilla&#x2F;Thunderbird&#x2F;Autoconfiguration" rel="nofollow">https:&#x2F;&#x2F;developer.mozilla.org&#x2F;en-US&#x2F;docs&#x2F;Mozilla&#x2F;Thunderbird...</a>
评论 #15322567 未加载
评论 #15322497 未加载
评论 #15322081 未加载
评论 #15321948 未加载
mirashii超过 7 年前
There&#x27;s nothing newsworthy here, just some guy trying to make a name for himself by giving his so called vulnerability a flashy name and website.
评论 #15321634 未加载
评论 #15321447 未加载
jlgaddis超过 7 年前
I find it funny that people are injecting alert()&#x27;s into the testing tool -- a vulnerability in a vulnerability report!<p>cf. <a href="https:&#x2F;&#x2F;leakyx.com" rel="nofollow">https:&#x2F;&#x2F;leakyx.com</a>.
DiThi超过 7 年前
So basically typosquatting? It seems to me that any service that doesn&#x27;t show the SSL certificate (or the EV name) is vulnerable to this, not just Exchange on iOS.<p>Edit: It seem it doesn&#x27;t check the SSL certificate either. But it&#x27;s super easy to get a valid SSL certificate nowadays, so just checking the SSL certificate for validity wouldn&#x27;t be enough.
评论 #15321830 未加载
Stranger43超过 7 年前
And all this while everyone is paying billions for complex info-sec software that does a lot less then it says on the tin. It&#x27;s similar to the epidemic problem with non-verified&#x2F;signed SSH keys where everyone just clicks Ok to any host-key presented. Though a bit more subtle, and something that should have been avoidable with a proper designed protocol.<p>It&#x27;s the kind of trivial little thing that gets ignored(along with boring old maintenance tasks like patching infrastructure servers ect.) not despite of but because of all the attention given and budget spend on attending conferences on cyber-warfare and never to be correctly installed(let alone monitored) infosec appliances.<p>Almost every major hack ever blamed on super advanced state sponsored groups turns out to be someone fumbling a routine update (like what happened with equifax and wannacry) or setting a bad password(guccifer 1+2 etc.) And yet the lesson that gets drawn is never, &quot;lets start following proper procedures for maintenance and training&quot; but &quot;lets reduce the maintenance budget some more by spending on infosec conferences and toys.&quot;
MichaelGG超过 7 年前
So a more realistic scenario might be after gaining access to a company&#x27;s LAN, or at a public WiFi? Did I read it right, you can force downgrade Exchange clients from TLS to plaintext, essentially?<p>What more did Apple say on the phone? No rationale given?
评论 #15321494 未加载
评论 #15321398 未加载
throwaway613834超过 7 年前
[Edit: nope, I misunderstood the issue... ignore my comment.]
评论 #15321390 未加载
评论 #15321388 未加载
frlnBorg超过 7 年前
Would this affect Office 365 hosted exchange servers?
评论 #15321480 未加载
mavhc超过 7 年前
Why is it sending a password at all?, surely it should be at least a hash of the password
评论 #15321394 未加载
评论 #15324123 未加载
评论 #15321847 未加载