Yaerion Posted January 2, 2023 Share Posted January 2, 2023 Hi there and happy new year! First of all: know that I've warned DE years ago about what I want to discuss here, and they didn't even bother to respond nor changed a thing, so I assume this is not a concern and safe to discuss. I'm just curious and want to understand it. I need this specimen for my sanctuary. The commercial link to the support (support.warframe.com on warframe.com and here below the forums) is an url that does not support https. I suppose with my low-knowledge that the page itself is just a server-side script of redirection, but I'm a bit concerned because our cookies/tokens & credential may be involved in the process, and I read here and there that http can easily be hacked/intercepted to inject malicious things (among which redirections to phishing sites)... so I'd like to hear from "white hats", web developers, sysadmins, coders or just tech-enthusiasts like me why this http page is considered secure by DE. Is there any risk of hack/data interception about it? If yes, why & how is it negligible? Link to comment Share on other sites More sharing options...
MqToasty Posted January 2, 2023 Share Posted January 2, 2023 It is negligible because it is just a redirect to: https://digitalextremes.zendesk.com/hc/en-us You never get a chance to enter any information on support.warframe.com, so the most a MITM (man in the middle) can capture is that your IP visited support.warframe.com, which they will have access to even if there was an https option. Unless I am missing some other attack that you are wondering about? Edit: Reading into it some more, I think you may be onto something. The example you provided is Example #3 on this page: https://support.securityscorecard.com/hc/en-us/articles/360058513252-Insecure-HTTPS-Redirect-Pattern ... so it would be valid if digitalextremes.zendesk.com had HSTS in place. Yet checking digitalextremes.zendesk.com on this site indicates that it does not have HSTS turned on, which means it is technically possible for a MITM / SSL-Stripping attack to occur: https://securityheaders.com/?q=digitalextremes.zendesk.com&followRedirects=on Link to comment Share on other sites More sharing options...
Yaerion Posted January 2, 2023 Author Share Posted January 2, 2023 So there is zero risk that an attacker could intercept and return the url of a phishing site (where the user could be pushed to enter Warframe-related personal data) instead of the legitimate DE-zendesk one? That is what I was concerned about when I did report this.* Edit: the above was a reply before the previous post edit. Link to comment Share on other sites More sharing options...
Yaerion Posted January 4, 2023 Author Share Posted January 4, 2023 No other expert assessment on this issue? MqToasty's research is rather concerning... Link to comment Share on other sites More sharing options...
Recommended Posts
Archived
This topic is now archived and is closed to further replies.