You may think it is difficult for the attacker to spoof the entire World Wide Web, but it is not. The attacker need not store the entire contents of the Web. The whole Web is available on-line; the attacker’s server can just fetch a page from the real Web when it needs to provide a copy of the page on the false Web.
The key to this attack is for the attacker’s Web server to sit between the victim and the rest of the Web. This kind of arrangement is called a “man in the middle attack” in the security literature.
URL Rewriting
The attacker’s first trick is to rewrite all of the URLs on some Web page so that they point to the attacker’s server rather than to some real server. Assuming the attacker’s server is on the machine www.attacker.org, the attacker rewrites a URL by adding http://www.attacker.org to the front of the URL. For example, http://home.netscape.com becomes http://www.attacker.org/http://home.netscape.com. (The URL rewriting technique has been used for other reasons by several other Web sites, including the Anonymizer and the Zippy filter. See page 9 for details.)
Figure 1 shows what happens when the victim requests a page through one of the rewritten URLs. The victim’s browser requests the page from www.attacker.org, since the URL starts with http://www.attacker.org. The remainder of the URL tells the attacker’s server where on the Web to go to get the real document.
Figure 1: An example Web transaction during a Web spoofing attack. The victim requests a Web page. The following steps occur: (1) the victim’s browser requests the page from the attacker’s server; (2) the attacker’s server requests the page from the real server; (3) the real server provides the page to the attacker’s server; (4) the attacker’s server rewrites the page; (5) the attacker’s server provides the rewritten version to the victim.
Once the attacker’s server has fetched the real document needed to satisfy the request, the attacker rewrites all of the URLs in the document into the same special form by splicing http://www.attacker.org/ onto the front. Then the attacker’s server provides the rewritten page to the victim’s browser.
Since all of the URLs in the rewritten page now point to www.attacker.org, if the victim follows a link on the new page, the page will again be fetched through the attacker’s server. The victim remains trapped in the attacker’s false Web, and can follow links forever without leaving it.
Jai Shree Raam
No comments:
Post a Comment