Re: SECURE SOCKETS LAYER COELACANTH: Phreak Phishing Expedition
From: Drew Copley (dcopley_at_EEYE.COM)
Date: Fri, 11 Jun 2004 15:48:15 -0700 To: NTBUGTRAQ@LISTSERV.NTBUGTRAQ.COM
As a addendum, perhaps, though I wouldn't doubt someone
might make some nice proof of concept code for this...
A similiar issue of this kind was found in IE a few
years ago - remember of course - it is IE's fault that they
are not properly parsing this, regardless of what they need
to parse... so this is ultimately a Microsoft bug...
Marc Slemko <firstname.lastname@example.org> Date: 2001-11-15 19:11:45 PST
"The patch for MS01-055 released today by Microsoft includes three
fixes. Two of them are for cookie stealing bugs. One of those
cookie stealing bugs was previously publicized on bugtraq, details on
other are now available at
The details are very trivial. Why am I writing up this big document
anyway? Hmm. Loading a URL such as:
...will cause IE to connect to the hostname specified, but send the
cookies to the server based on the hostname before the "%20", in this
case passport.com. The "%20" is the URL encoded version of a space
character. "%20" isn't the only character that works, there are a
variety of others that are also misparsed.
For this to work, the hostname "passport.com
must be resolvable as a hostname by the client. In this case, I did
this by creating a wildcard A record for *.sub.znep.com, so any
hostname under sub.znep.com will get resolved to a particular IP
address. This attack does require that the attacker have access to
configure a DNS server in such a way, however gaining such access
anonymously or pseudo-anonymously is trivial.
Similiar yet quite different in affect, for in one case, you did
not have full spoofing -- now you have full spoofing, which allows
you to run code.
I am quite surprised Microsoft did not properly fix this way back
I believe some old, free dns systems should allow these kinds of
wildcards, like dyndns, but I am not sure. There should certainly
be other methods of exploitation, regardless... and it very well may
some ownable sites already -- if not some free hosting sites.
> -----Original Message-----
> From: email@example.com [mailto:firstname.lastname@example.org]
> Sent: Thursday, June 10, 2004 8:08 PM
> To: Drew Copley; email@example.com
> Cc: firstname.lastname@example.org
> Subject: SECURE SOCKETS LAYER COELACANTH: Phreak Phishing Expedition
> as sent out, this is the one that didn't get away :)
> We wrap this up with a full-on ssl site spoof. It seems limited
> how far you can 'shove' the real domain out of the way, but just
> enough to make it convincing so we adapt the window to 'cover'
> it up. Interestingly [with apologies to e-gold for playing with
> their site], they have a secured connection [ignore the warning]
> which gives us our https, our little golden 'safe' padlock and
> most interestingly, all the links inside the site function and
> show the spoofed address:
> couple all that with the absurd ability to trick Internet
> Explorer into believing it is in a 'trusted zone' by inserting
> whatever gibberish you want into the fake link regardless of the
> actual domain, and you have the catch of the day.
> Big thanks to Drew Copley for whacking the sucker on the head,
> Brett Moore for correctly pointing out that it can be achieved
> without the 'redir' thing as well being able to stuff it with
> anything else you want and expedition leader: 'bitlance winter'
> who sighted it, tracked it, snagged it and reeled it in.
> End Call
NTBugtraq Editor's Note:
Want to reply to the person who sent this message? This list is configured such that just hitting reply is going to result in the message coming to the list, not to the individual who sent the message. This was done to help reduce the number of Out of Office messages posters received. So if you want to send a reply just to the poster, you''ll have to copy their email address out of the message and place it in your TO: field.