Home » Posts tagged "bypass"

LinkedIn 忘記續約導致 SSL Certificate 過期

Netcraft 上看到 LinkedIn 出包的消息,這次是 country-mixed 的版本出包:「LinkedIn certificate blunder leaves users LockedOut!」。

在 DNS 上也可以看出來這兩個 CNAME 到不一樣的 load balancer 上:

www.linkedin.com.       260     IN      CNAME   2-01-2c3e-003c.cdx.cedexis.net.
2-01-2c3e-003c.cdx.cedexis.net. 93 IN   CNAME   pop-ehk1.www.linkedin.com.
pop-ehk1.www.linkedin.com. 3560 IN      A
de.linkedin.com.        86400   IN      CNAME   cctld.linkedin.com.
cctld.linkedin.com.     86400   IN      CNAME   mix.linkedin.com.
mix.linkedin.com.       213     IN      CNAME   pop-ehk1.mix.linkedin.com.
pop-ehk1.mix.linkedin.com. 3546 IN      A

SSL Labs 上也看得出來在 Alternative names 的地方是不一樣的:「SSL Server Test: www.linkedin.com (Powered by Qualys SSL Labs)」、「SSL Server Test: de.linkedin.com (Powered by Qualys SSL Labs)」。

然後因為 LinkedIn 有設定 HSTS,所以使用者在界面上完全無法登入:

Google Chrome 上可以用 badidea 繞過 (參考「在 Google Chrome 連上因 HSTS 而無法連線的網站」),但在 Mozilla Firefox 上的話目前沒找到方法可以在界面上 bypass,而是需要改 SiteSecurityServiceState.txt 這個檔案:「HTTP Strict Transport Security prevents me from accessing a server that I'm doing development on」。

不過也因為兩個 cluster 獨立運作,網址改一下應該就會動了...

這幾年比較很少看到大公司出這種包,還蠻有趣的 XD

Google Chrome 會 bypass Adblock 的問題

新版的 Google Chrome 使得 YouTube 可以繞過 Adblock 類軟體的阻擋限制 (像是 uBlock Origin),導致這些使用者會需要「看完完整的廣告影片 (無法 skip)」才能看本篇:「Google Chrome reportedly bypassing Adblock, forces users to watch full-length video ads」。

目前確認這是在修正 CVE-2015-1297 時產生的 bug:

Update: We have been contacted by Rob Wu, a developer on the Chromium project - the open-source foundation for the Chrome browser - who has informed us that this change was not intentional but, rather, an unintended result of fixing a previous security issue (CVE-2015-1297). He confirmed that the issue will only be seen if the YouTube app is installed and that, at the moment, apart from disabling AdBlock or whitelisting YouTube, the only solution, as described above, is to uninstall the app. The problem is expected to be patched in the upcoming weeks or, at least, when Chrome 46 is released.

目前的暫時解法是移除掉 YouTube 這隻 app,或是將 YouTube 放到白名單網站。