WPAD Windows
Web Proxy Auto-Discovery Protocol (WPAD) — , () (URL) DHCP / DNS. FindProxyForURL PAC-, URL . — , .
WPAD Windows, . ,
(Alex Chapman) (Paul Stone) Defcon. , , ( , , , ..), HTTPS VPS . , — man-in-the-middle.
PAC- Dynamic Host Configuration Protocol (DHCP), Domain Name System (DNS) Link-Local Multicast Name Resolution (LLMNR). WPAD, PAC-, -, . , , , .
, WPAD . WPAD , Windows-, .
- HTTP-. , HTTPS (HTTP Secure). , PAC- -, DNS lookup, -«» , HTTPS URL .
HTTPS URL , . . ,
example.com/login?authtoken=ABC1234 DNS- https.example.com.login.authtoken.ABC1234.leak .
, , . , . , .
, . . ( ).
, , Facebook Google, 302 HTTP URL . , , , .
Windows WPAD « »., , , . OAuth, , Facebook, Google Twitter .
Defcon. , , , Google, Google Drive. , HTTPS-, - . WPAD, HTTPS . , c VPN. WPAD .
, VPN-, OpenVPN, , WPAD. , , , VPN, - . , .
WPAD, . , , . OS X, iOS, Apple TV, Android, Google Chrome. Microsoft Mozilla .
?
— WPAD. PAC - ,
WPAD URL .
— , WPAD. Black Hat. Verisign , WPAD- , . WPAD .global, .ads, .group, .network, .dev, .office, .prod, .hsbc, .win, .world, .wan, .sap, and .site.
, , , , . , , «» PAC- , , WPAD .