Insecure http pages referencing https form-actions.

[fd () ew nsci us]

Today I realized that many "secured" web sites reference their secure 
login page from an insecure page.  For example:

http://www.some-luser.com/login.html:
  <form action="https://cgi.some-luser.com/login-cgi";>
    user: <input name=user> 
    pass: <input name=pass>
  </form>

The actual post is secure (several assumptions made), but not the page
which contains the form itself!  In my mind, it would be rather trivial to
man-in-the-middle or DNS poison www.some-luser.com and change the content
of login.html's form-action to http://not-secure-luser.com/login-cgi.  If
Eve hosts not-secure-luser.com then login credentials will be posted to
her rather than to where it is expected.

With some javascript magic, Eve could even post the victim back into
https://cgi.some-luser.com/login-cgi.  Except for the extra delay and
perhaps a "please wait while you are logged in" page (ajax anyone?), Bob
*and* Alice would never know.

Am I missing something here?  Are "secure" web designers really
overlooking the obvious?

-Eric


--
Eric Wheeler
Vice President
National Security Concepts, Inc.
PO Box 3567
Tualatin, OR 97062

http://www.nsci.us/
Voice: (503) 293-7656
Fax:   (503) 885-0770


--
Here's a topic: foo.  Discuss amongst yourselves ...

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/