• 1 Post
  • 213 Comments
Joined 4 years ago
cake
Cake day: December 20th, 2021

help-circle






  • drspod@lemmy.mltoSelfhosted@lemmy.worldHow to selfhost with a VPN
    link
    fedilink
    English
    arrow-up
    4
    arrow-down
    3
    ·
    2 months ago

    Anyone with the ability to inject or modify packets in the network path between server and client can inject malicious javascript or browser exploits into an unencrypted HTTP TCP stream. The client’s User-Agent and other headers would allow the attacker to customize their attack to target that specific browser version, and compromise the client machine.


  • It’s a clever attack but if I understand correctly it requires malicious script to be injected into a trusted webpage (ie. one that you normally log in to). This limits the utility of the attack, since any script injection vulnerability would already allow exfiltration of credentials that are entered manually when you log in to the site, password manager or not. The difference with this attack is that the attacker doesn’t have to wait for you to log in, they just trick the password manager into autofilling the credentials straight away.