Question
A company's user accounts have been compromised. Users are also reporting that the company's internal portal is sometimes only accessible through HTTP; other times, it is accessible through HTTPS. Which of the following most likely describes the observed activity?
- A. There is an issue with the SSL certificate causing port 443 to become unavailable for HTTPS access
- B. An on-path attack is being performed by someone with internal access that forces users into port 80 Correct
- C. The web server cannot handle an increasing amount of HTTPS requests so it forwards users to port 80
- D. An error was caused by BGP due to new rules applied over the company's internal routers
Explanation
Intermittent downgrades from HTTPS to HTTP combined with compromised accounts point to an on-path (SSL stripping) attack: an attacker inside the network intercepts traffic, serves the portal over plain HTTP on port 80 and captures credentials in clear text. A certificate problem would produce browser errors rather than silent HTTP access, web servers do not fall back to HTTP under load, and BGP changes affect routing between networks, not the protocol a user sees.
