{"@attributes":{"version":"2.0"},"channel":{"title":"security on Ceda EI's Blog","link":"https:\/\/cedaei.com\/tags\/security\/","description":"Recent content in security on Ceda EI's Blog","generator":"Hugo -- gohugo.io","language":"en-us","copyright":"CC-BY-SA 4.0","lastBuildDate":"Sat, 25 Dec 2021 00:00:00 +0000","item":{"title":"Figuring Out HTTPS MITM in India","link":"https:\/\/cedaei.com\/posts\/figuring-out-https-mitm\/","pubDate":"Sat, 25 Dec 2021 00:00:00 +0000","guid":"https:\/\/cedaei.com\/posts\/figuring-out-https-mitm\/","description":"

Belonging to India, I am very used to seeing random websites being blocked.\nHowever, today was particularly scary because the MITM (Man In The Middle\nattack)<\/a>\n happened over\nHTTPS. I visited usebottles.com<\/a>\n over HTTPS and was\nserved with the following page.<\/p>\n

\"\"<\/p>\n

Notice the padlock in the address bar. Checking into it, the certificate is\nvalid and signed by Cloudflare<\/a>\n.<\/p>\n

\"\"<\/p>\n

Further Exploration and Hypothesis<\/h2>\n

The initial hypothesis was that the Indian Government or the ISP has\nCloudflare’s signing keys and are serving the blocked page over HTTPS. This\nseems unlikely however and would be a very severe thing and would essentially\nerode all trust in HTTPS at scale as Cloudflare can sign any website’s domain\nwhich essentially means that ISPs could MITM<\/p>\n

After a bit of exploration, the DNS entry of\nusebottles.com<\/a>\n points to 172.67.197.25<\/code> and\n104.21.92.184<\/code>. I checked that both of these IPs were owned by Cloudflare. To\nensure that the DNS entries weren’t being MITM attacked either, I checked for\nthe same from my Hetzner Server.<\/p>\n

The second possibility that arises from this is that Cloudflare itself was\nserving the blocked page. While more likely than the previous scenario, it is\nstill unlikely generally. I looked for any notices from Cloudflare about this\nand could not find any.<\/p>\n

At this point, I was mostly out of ideas. I looked into the source of the page\nand found something interesting. The entire page’s source was the following\n(invalid) HTML:<\/p>\n

<meta name="viewport" content="width=device-width,initial-scale=1.0,maximum-scale=1.0" \/>\n<style>\n    body {\n        margin: 0px;\n        padding: 0px;\n    }\n\n    iframe {\n        width: 100%;\n        height: 100%\n    }\n<\/style>\n<iframe src="https:\/\/www.airtel.in\/dot\/" width="100%" height="100%" frameborder=0><\/iframe>\n<\/code><\/pre>\n
The most interesting part of this was that the iframe’s URL pointed to\nairtel.in<\/a>\n. Airtel is an ISP in India, however, I was\nnot using internet services from Airtel.<\/p>\n
My presumption is based on this.<\/p>\n
Final Hypothesis<\/h2>\n
This is what I presume is happening.<\/p>\n
Me <---> Cloudflare <---> usebottles' server\n     1                2\n<\/code><\/pre>\n
So far, we have been assuming the MITM is happening at 1<\/code> i.e. between Me and\nCloudflare. However, the fact that 2<\/code> is secure isn’t guaranteed.<\/p>\n
My best guess is that the Cloudflare server I am getting connected to happens\nto be using Airtel as the ISP. When Cloudflare’s server tries to connect to\nusebottles' server, Cloudflare gets MITM attacked by their ISP - Airtel.\nLikely, SSL is not enforced between Cloudflare and usebottles' server. Thus,\nCloudflare connects to usebottles' server over HTTP.<\/p>\n
Normally, a connection would happen the following way:<\/p>\n
    \n
  1. I connect to https:\/\/usebottles.com\/<\/a>\n<\/li>\n
  2. I get connected to Cloudflare’s server.<\/li>\n
  3. Cloudflare’s server reaches out to usebottle’s server.<\/li>\n
  4. usebottles' server sends a response.<\/li>\n
  5. Cloudflare signs the response with the certificate.<\/li>\n
  6. I get a webpage over HTTPS.<\/li>\n<\/ol>\n
    What seems to be happening is:<\/p>\n
      \n
    1. I connect to https:\/\/usebottles.com\/<\/a>\n<\/li>\n
    2. I get connected to Cloudflare’s server.<\/li>\n
    3. Cloudflare’s server reaches out to usebottle’s server.<\/li>\n
    4. Airtel intercepts the request and sends the blocking page<\/strong><\/li>\n
    5. Cloudflare signs the blocking page<\/strong> with the certificate.<\/li>\n
    6. I get blocking page<\/strong> served over HTTPS.<\/li>\n<\/ol>\n
      I would be interested in knowing if there are any alternative explanations to\nthis or something I have missed. You can contact\nme<\/a>\n to let me know!<\/p>\n"}}}