ALPACA: Application Layer Protocol Confusion-Analyzing And Mitigating Cracks In TLS Authentication

Advertisement

In cooperation with the university Paderborn and Münster University of Applied Sciences, we discovered a new flaw in the specification of TLS. The vulnerability is called ALPACA and exploits a weakness in the authentication of TLS for cross-protocol attacks. The attack allows an attacker to steal cookies or perform cross-site-scripting (XSS) if the specific conditions for the attack are met.

TLS is an internet standard to secure the communication between servers and clients on the internet, for example that of web servers, FTP servers, and Email servers. This is possible because TLS was designed to be application layer independent, which allows its use in many diverse communication protocols.

ALPACA is an application layer protocol content confusion attack, exploiting TLS servers implementing different protocols but using compatible certificates, such as multi-domain or wildcard certificates. Attackers can redirect traffic from one subdomain to another, resulting in a valid TLS session. This breaks the authentication of TLS and cross-protocol attacks may be possible where the behavior of one protocol service may compromise the other at the application layer.

We investigate cross-protocol attacks on TLS in general and conducted a systematic case study on web servers, redirecting HTTPS requests from a victim's web browser to SMTP, IMAP, POP3, and FTP servers. We show that in realistic scenarios, the attacker can extract session cookies and other private user data or execute arbitrary JavaScript in the context of the vulnerable web server, therefore bypassing TLS and web application security.

We evaluated the real-world attack surface of web browsers and widely-deployed Email and FTP servers in lab experiments and with internet-wide scans. We find that 1.​4M web servers are generally vulnerable to cross-protocol attacks, i.e., TLS application data confusion is possible. Of these, 114k web servers can be attacked using an exploitable application server. As a countermeasure, we propose the use of the Application Layer Protocol Negotiation (ALPN) and Server Name Indication (SNI) extensions in TLS to prevent these and other cross-protocol attacks.

Although this vulnerability is very situational and can be challenging to exploit, there are some configurations that are exploitable even by a pure web attacker. Furthermore, we could only analyze a limited number of protocols, and other attack scenarios may exist. Thus, we advise that administrators review their deployments and that application developers (client and server) implement countermeasures proactively for all protocols.

More information on ALPACA can be found on the website https://alpaca-attack.com/.

More articles

  1. Nsa Hacker Tools
  2. Android Hack Tools Github
  3. Hacker Tools Apk Download
  4. Hacking Tools Free Download
  5. Hacker
  6. Pentest Tools For Ubuntu
  7. Pentest Reporting Tools
  8. Bluetooth Hacking Tools Kali
  9. What Are Hacking Tools
  10. Hacker Tool Kit
  11. Pentest Tools For Mac
  12. Pentest Automation Tools
  13. Ethical Hacker Tools
  14. Android Hack Tools Github
  15. Hackers Toolbox
  16. Pentest Automation Tools
  17. Hack Tools Download
  18. Pentest Tools Find Subdomains
  19. Hacker Hardware Tools
  20. Pentest Tools Github
  21. Pentest Tools Kali Linux
  22. How To Hack
  23. Pentest Tools Download
  24. Hacking Tools And Software
  25. Hacker Tools Linux
  26. Hacking Tools For Mac
  27. Wifi Hacker Tools For Windows
  28. Pentest Tools Url Fuzzer
  29. Hacking Tools And Software
  30. Nsa Hacker Tools
  31. Hacking Tools Online
  32. Hacker Tools For Windows
  33. How To Make Hacking Tools
  34. Hacker Tools For Ios
  35. Hacker Tools Apk Download
  36. Pentest Tools Download
  37. Pentest Tools
  38. Easy Hack Tools
  39. New Hack Tools
  40. Hack Tools Github
  41. Hacker Hardware Tools
  42. Hacker Tools Windows
  43. Beginner Hacker Tools
  44. What Are Hacking Tools
  45. Hack Tools For Windows
  46. Easy Hack Tools
  47. Hack Tools For Games
  48. Hacking Tools 2020
  49. Hack Tools Github
  50. Hacker
  51. What Is Hacking Tools
  52. Pentest Recon Tools
  53. Hacker Tools For Ios
  54. Pentest Tools Framework
  55. Pentest Reporting Tools
  56. Hacking Tools Windows 10

Arsip Blog

Copyright © 2009 - - Kiamat | Coin Free Faucet Claim | Firebug Theme by Blog Oh! Blog | Converted to Blogger Template by ThemeLib.com | Jasa Promosi Online - Tukar Link Gratis