start.ubuntu.com is unencrypted and expose user searches

Bug #1680181 reported by Clark Winkelmann
256
This bug affects 1 person
Affects Status Importance Assigned to Milestone
Ubuntu Start Page
Fix Released
Undecided
Unassigned

Bug Description

There are actually two HTTP issues with the Ubuntu start page (http://start.ubuntu.com)

First, all user searches are exposed in plain text because searches are made to http://www.google.com/search . Because Google does not send an HSTS header (yet?), this happen every single time a user starts a search.

Second, the start page, as well as Google are loaded via HTTP, allowing for easy and powerful Man-in-the-middle attacks. It's even more dangerous than most MitM attacks because:

- The page is opened with the browser by default. A new user opening Firefox can't go around it
- If the page is loaded with `about:startpage`, nothing is displayed to the user in the address bar, so the user won't suspect a thing. It's perfect to display fake Firefox modals or just about anything
- You can easily create phishing pages for www.google.com that users may trust even if there's no green lock

I checked this on Ubuntu 16.04, but I think all versions of Ubuntu are exposed because the same landing page is used and every distribution fetches it at http://start.ubuntu.com

I first thought the start page was a static html built into the Ubuntu modifications for Firefox and tweeted about it https://twitter.com/clarkwinkelmann/status/849673869749342208

I then realized the page was fetched from your own server over the internet over plain text, so I believe that's a very serious security issue. Your start.ubuntu.com server does not even accept HTTPS requests !

Related branches

Revision history for this message
Clark Winkelmann (clark-winkelmann) wrote :

I just saw that the Google HTTP issue is already tracked here #1207489

Haw Loeung (hloeung)
Changed in ubuntu-start-page:
status: New → Confirmed
information type: Private Security → Public Security
Changed in ubuntu-start-page:
status: Confirmed → Fix Released
To post a comment you must log in.
This report contains Public Security information  
Everyone can see this security related information.

Other bug subscribers

Remote bug watches

Bug watches keep track of this bug in other bug trackers.