In cooperation with the university Paderborn and Münster University of Applied Sciences, we discovered a new flaw in the specification of TLS. The vulnerability is called ALPACA and exploits a weakness in the authentication of TLS for cross-protocol attacks. The attack allows an attacker to steal cookies or perform cross-site-scripting (XSS) if the specific conditions for the attack are met.
TLS is an internet standard to secure the communication between servers and clients on the internet, for example that of web servers, FTP servers, and Email servers. This is possible because TLS was designed to be application layer independent, which allows its use in many diverse communication protocols.
ALPACA is an application layer protocol content confusion attack, exploiting TLS servers implementing different protocols but using compatible certificates, such as multi-domain or wildcard certificates. Attackers can redirect traffic from one subdomain to another, resulting in a valid TLS session. This breaks the authentication of TLS and cross-protocol attacks may be possible where the behavior of one protocol service may compromise the other at the application layer.
We investigate cross-protocol attacks on TLS in general and conducted a systematic case study on web servers, redirecting HTTPS requests from a victim's web browser to SMTP, IMAP, POP3, and FTP servers. We show that in realistic scenarios, the attacker can extract session cookies and other private user data or execute arbitrary JavaScript in the context of the vulnerable web server, therefore bypassing TLS and web application security.
We evaluated the real-world attack surface of web browsers and widely-deployed Email and FTP servers in lab experiments and with internet-wide scans. We find that 1.4M web servers are generally vulnerable to cross-protocol attacks, i.e., TLS application data confusion is possible. Of these, 114k web servers can be attacked using an exploitable application server. As a countermeasure, we propose the use of the Application Layer Protocol Negotiation (ALPN) and Server Name Indication (SNI) extensions in TLS to prevent these and other cross-protocol attacks.
Although this vulnerability is very situational and can be challenging to exploit, there are some configurations that are exploitable even by a pure web attacker. Furthermore, we could only analyze a limited number of protocols, and other attack scenarios may exist. Thus, we advise that administrators review their deployments and that application developers (client and server) implement countermeasures proactively for all protocols.
More information on ALPACA can be found on the website https://alpaca-attack.com/.
Read more
- Tools For Hacker
- Pentest Tools Tcp Port Scanner
- Pentest Reporting Tools
- Hack Tools Download
- Hacking Tools For Beginners
- Hacker Tools Free
- Blackhat Hacker Tools
- Hacking Tools
- Hacking Tools Usb
- Pentest Tools Url Fuzzer
- Hacking Tools Free Download
- Hacking Tools For Windows Free Download
- Hacking Tools Download
- Hacks And Tools
- Hacking Tools Pc
- Hacker Tools Online
- Hack Rom Tools
- Hacker Tools Linux
- Nsa Hacker Tools
- Hacker Security Tools
- Hacker Tools Github
- Pentest Tools Alternative
- Hack Tools For Ubuntu
- Hacking App
- Pentest Tools For Windows
- Hacker Security Tools
- Game Hacking
- Pentest Tools Kali Linux
- Hacker Tools List
- Pentest Tools Windows
- Underground Hacker Sites
- Hacker Tool Kit
- Hack Tools For Pc
- Install Pentest Tools Ubuntu
- Android Hack Tools Github
- Blackhat Hacker Tools
- Hack Tools Pc
- Underground Hacker Sites
- Hacking Tools Software
- Hackers Toolbox
- What Is Hacking Tools
- Hacking Tools Usb
- Pentest Automation Tools
- Hacker Hardware Tools
- Pentest Box Tools Download
- Hacker Tools Free Download
- Hacker Tools Github
- Hacker Tools 2019
- Hacker Tools For Windows
- Hacking Tools Usb
- Hak5 Tools
- Beginner Hacker Tools
- Github Hacking Tools
- Pentest Tools Url Fuzzer
- Pentest Tools Apk
- Hack Tools
- Hack Tools For Mac
- Pentest Tools Port Scanner
- Hacker Tools Apk Download
- Hacker Tools List
- Hack Tools
- Tools Used For Hacking
- Hacking Tools Name
- New Hacker Tools
- Hacking Tools Usb
- Underground Hacker Sites
- New Hacker Tools
- Pentest Tools Kali Linux
- Hacker
- Hack Tools Online
- Best Hacking Tools 2020
- Pentest Tools For Windows
- Nsa Hack Tools Download
- Hacking Tools For Mac
- Hacking App
- Hacking Tools For Mac
- Hacker Tool Kit
- Best Pentesting Tools 2018
- New Hack Tools
- Blackhat Hacker Tools
- Pentest Reporting Tools
- Pentest Tools Website
- Hacker Hardware Tools
- Hacking App
- Pentest Tools Github
- Hacking Tools Github
- Pentest Tools Url Fuzzer
- Hacker Security Tools
- Physical Pentest Tools
- Hacking Tools For Beginners
- Kik Hack Tools
- Best Hacking Tools 2019
- Hacking Tools For Windows Free Download
- Hacking Tools For Beginners
- Pentest Tools Alternative
- Pentest Tools Bluekeep
- Install Pentest Tools Ubuntu
- Pentest Tools Alternative
- Hacking Tools For Beginners
- Hack Tools For Windows
- Hack Tools For Pc
- Pentest Tools Windows
- Underground Hacker Sites
- Best Pentesting Tools 2018
- Hack Tools For Pc
No comments:
Post a Comment