Thank you for saving what hair I haven’t pulled out yet.

I found your entry interesting do I’ve added a Trackback to it on my weblog …

I did it the other day to my wife’s computer with Cain and Able, noticing that she was looking at more shoes to buy… Didn’t need to hijack her WPAD queries or DNS lookups to accomplish this task.

What WPAD does provide is the ability to have users dynamically find a proxy server. And the users don’t have to know anything about manually configuring (and enabling/disabling) a hard coded proxy server.

Security, as you obviously know, is a balance between functionality and safety. The only truly secure client is one that is turned off…

So this is really just another example of where it is up to the individual/management to determine if the risk of web hijacking outweighs the cost of manually managing the proxy configuration.

From my experience the WPAD feature is not used because of a general lack of knowledge and understanding on the technology. After all, it’s easy to slam in a proxy server with GPO’s…

Essentially, they just print out a check with your routing & account numbers on it, print “Signature on file” for the signature line, and give it to their bank. The bank then has your bank debit your account and put the money into theirs. These days it’s usually done electronically rather than by “printing” anything.

Since I originally made this post, it’s gotten a little harder, as the bank issuing the draft is now liable for fraud, rather than the bank paying it. You still have the fundamental problem that the money is already gone and you have to get it back, but at least banks are putting more effort into preventing the fraud as they’ve started to lose their own money to it. There’s a statement from the FTC here that tells a bit more about how it works.

It’s a fraud that requires some setup time — i.e. you need to set up a fake business, get some bank accounts, process some legitimate drafts, and then commit the fraud. You can’t (anymore!) just go to a web site, enter somebody’s account number, and take all the money out. Checking account numbers are, however, still much riskier to give out than credit card numbers, and it’s still a much bigger pain to get the money back.

On the other hand, if you mean attacks not against IE but against SSL itself, such as Moxie’s SSLSniff, they’re hard to detect. One thing that helps is actually opening and verifying the certificate — just because the padlock icon is there doesn’t mean you’re communicating with what you think you’re communicating with. Most of the time attackers don’t forge an entire certificate, just the domain name, so everything else may look wrong (or the certificate may be for * rather than a specific domain.) Once again, use a current, fully-patched browser, as this protects you from null-byte certificates (which actually may look perfect if you inspect them.) And most importantly of all, don’t use insecure wireless networks. Attacks like SSLSniff rely on being a man-in-the-middle — that is, an attacker must be able not just to read your communication but also to modify it. This means either he has to control a router between you and the website you’re talking to, or he has to be on a wireless network with you. The only safe thing to do on an insecure (open or WEP) wireless network is to VPN to a secure network. Anything else is vulnerable.

The torrent of choice must always be the one with the most seeds, not with the most leechers.

he might even report bad quality etc, pointing out the waste of time, problem is, people dont really read before downloading, automating the verifcation could help.

–Peter
peter@tunecore.com