Lack of HTTPS on Amazon 2015

If you are browsing Amazon and someone is trying to capture your data and connection, then the person can easily see what you are browsing on Amazon or things you are buy.

If you commonly visit Amazon then you might have noticed

that Amazon is not using HTTPS everywhere on their

website. Only a few pages are HTTPS .

Even, the person who is spying can see what has been purchased. This is how it can be done. Suppose you bought an IPod on Amazon one month ago. One day, you thought you need to see the warranty date. You go back to the website and click on My purchases. That page is secure(HTTPS). Then you click on your item. You go back to the page which is not secure(HTTP). The hacker again gained access to what you are looking at. The hacker gained access because of the ref field in the url bar, which tells the hacker from which page the victim is coming.

So, in this way, you compromise your security because of the fault of website. Stephen Merity found this problem and contacted Amazon they replied with no good news so he thought to share it with others. Stephen Merity wrote this in his blog :-

I reported this to Amazon previously via their security email but received a boilerplate response. Considering anyone interested in utilizing this information leak would already be doing so, I feel it’s worth raising awareness about the situation. At the very least, it adds to some of my previous articles on the lack of default HTTPS on Google Analytics and when HTTP referrers appear and disappear.

This could have been easily fixed by removing the ref variable from the URL bar , but Amazon did nothing.

The attacker can also get information, like last purchased, or from whom, etc

STAY CONNECTED!!

Comments

Create Your Own Social Networking Site

Create Your Own Social Networking Site JCOW: Ethical Hacking Top 10 reasons to choose Jcow:- 1. Handle more traffic - Clean codes and Dynamic caching can lower the CPU load and speed up your website. 2 Make your site more interactive - Well designed Jcow applications help you members to connect and communicate with others more effectively. 3 Add questions to the Registration Form - You can add new member fields, which will be displayed to the registration form, profile form, and the member browsing form. 4 Easily share stuff - Within the AJAX sharing Box, your members can publish status, photos, videos, and blogs. 5 Customize and Extend your Jcow Network - A Jcow network consists of core apps(like "Friends" and "Messages") and optional apps(like "Blogs" and ""Videos"). You can enable/disable optional apps. You can also develop your own apps. 6 Every profile could be Unique - Members can customize their own profile theme and add music play...

Hack WiFi Account From Phishing Attack With WifiPhisher

WiFi Phishing Attack With WifiPhisher Tool Wifiphisher is a security tool that mounts fast automated phishing attacks against WiFi networks in order to obtain secret passphrases and other credentials. It is a social engineering attack that unlike other methods it does not include any brute forcing. It is an easy way for obtaining credentials from captive portals and third party login pages or WPA/WPA2 secret passphrases. From the victim's perspective, the attack makes use in three phases: 1. Victim is being deauthenticated from her access point. Wifiphisher continuously jams all of the target access point's wifi devices within range by sending deauth packets to the client from the access point, to the access point from the client, and to the broadcast address as well. 2. Victim joins a rogue access point. Wifiphisher sniffs the area and copies the target access point's settings. It then creates a rogue wireless access point that is modeled on the target. It also sets up ...

Latest Notepad Tricks 2015 !!

By these Latest Notepad Tricks 2015 you will be having great fun. You just need is to copy the code from here and paste in the notepad and save it with extension “ .bat ” . 1 Notepad trick to Test Antivirus :- By using these trick you can easily test your antivirus working perfectly or not. X5O!P%@AP[4PZX54(P^) 7CC)7}$EICAR-STANDARD- ANTIVIRUS-TEST-FILE!$H+H* save it as test.exe and run the file and check if your antivirus detects it then your antivirus working perfectly otherwise change your antivirus. 2 Make A Personal Log-Book or A Diary :- Copy the below code and paste it in notepad and save it as “ log.txt”. .LOG Now every time you open this log file you will have all the log details with date and time. 3 Constantly Repeat Any Messages :- This is one of the Latest Notepad tricks that will repeat any of messages on computer screen repeatedly.Just copy the below code and paste in the notepad and save it as “ message.bat”. @ECHO off...

DOYLC

Search This Blog