Security: Some default sites in the new tab page on Android don't use SSL
Reported by
ya...@nightwatchcybersecurity.com,
Nov 23 2017
|
||||
Issue descriptionVULNERABILITY DETAILS Please provide a brief explanation of the security issue. VERSION Chrome Version: 62.0.3202.84 stable Operating System: Android 7.0.0 REPRODUCTION CASE 1. Open Chrome on Android. 2. Go to Settings, Privacy and clear out all data. 3. Re-open, and open new tab 4. Observe that the icons of popular sites are displayed. NOT ALL OF THEM use SSL - in the US, ESPN doesn't and in UK, Argos.co.uk has no SSL while they actually support SSL The result is that a user using Chrome that clicks on any of these, on a hostile network can end up being directed to an attacker's site if DNS or MITM is used. The source of these seems to come from a Google service here: https://www.gstatic.com/chrome/ntp/suggested_sites_DEFAULT_5.json They are used in this file in code: https://cs.chromium.org/chromium/src/components/ntp_tiles/popular_sites_impl.cc The fix maybe on the Google side and not in code, or perhaps code can be added not to display non-SSL sites. Screenshot of US Chrome is attached.
,
Nov 24 2017
I thought the popular sites pipeline would prefer https pages... Mikel can you have a look?
,
Nov 24 2017
To check on our side how to best promote HTTPS pages (if provided), I created bug http://b/69732098. There are some difficulties for loading HTTPS instead of their HTTP equivalent in general, as they might be reachable, but broken. For example, ESPN can be accessed via HTTPS but it still loads images, scripts and styles via HTTP. The mixed content will be blocked and the site won't be usable. BTW: HSTS preloading feathers this fall for some HTTP recommendations which would automatically be replaced by the appropriate HTTPS site. More information about that here: https://hstspreload.org Spoiler: It doesn't work for ESPN or Argos.
,
Jan 15 2018
,
Mar 16 2018
|
||||
►
Sign in to add a comment |
||||
Comment 1 by jialiul@chromium.org
, Nov 23 2017Labels: -Type-Bug-Security -Restrict-View-SecurityTeam Type-Bug