In cooperation with the university Paderborn and Münster University of Applied Sciences, we discovered a new flaw in the specification of TLS. The vulnerability is called ALPACA and exploits a weakness in the authentication of TLS for cross-protocol attacks. The attack allows an attacker to steal cookies or perform cross-site-scripting (XSS) if the specific conditions for the attack are met.
TLS is an internet standard to secure the communication between servers and clients on the internet, for example that of web servers, FTP servers, and Email servers. This is possible because TLS was designed to be application layer independent, which allows its use in many diverse communication protocols.
ALPACA is an application layer protocol content confusion attack, exploiting TLS servers implementing different protocols but using compatible certificates, such as multi-domain or wildcard certificates. Attackers can redirect traffic from one subdomain to another, resulting in a valid TLS session. This breaks the authentication of TLS and cross-protocol attacks may be possible where the behavior of one protocol service may compromise the other at the application layer.
We investigate cross-protocol attacks on TLS in general and conducted a systematic case study on web servers, redirecting HTTPS requests from a victim's web browser to SMTP, IMAP, POP3, and FTP servers. We show that in realistic scenarios, the attacker can extract session cookies and other private user data or execute arbitrary JavaScript in the context of the vulnerable web server, therefore bypassing TLS and web application security.
We evaluated the real-world attack surface of web browsers and widely-deployed Email and FTP servers in lab experiments and with internet-wide scans. We find that 1.4M web servers are generally vulnerable to cross-protocol attacks, i.e., TLS application data confusion is possible. Of these, 114k web servers can be attacked using an exploitable application server. As a countermeasure, we propose the use of the Application Layer Protocol Negotiation (ALPN) and Server Name Indication (SNI) extensions in TLS to prevent these and other cross-protocol attacks.
Although this vulnerability is very situational and can be challenging to exploit, there are some configurations that are exploitable even by a pure web attacker. Furthermore, we could only analyze a limited number of protocols, and other attack scenarios may exist. Thus, we advise that administrators review their deployments and that application developers (client and server) implement countermeasures proactively for all protocols.
More information on ALPACA can be found on the website https://alpaca-attack.com/.
More info
- Hacker Tools For Windows
- How To Make Hacking Tools
- Hack Tools For Windows
- New Hack Tools
- Pentest Reporting Tools
- Black Hat Hacker Tools
- Pentest Tools Android
- Blackhat Hacker Tools
- Hacking Tools For Windows Free Download
- Wifi Hacker Tools For Windows
- Pentest Tools Windows
- Hacker Tools For Pc
- Hacker Techniques Tools And Incident Handling
- Computer Hacker
- Pentest Reporting Tools
- Hacker Tools Github
- Hacker Tools Github
- Pentest Tools Subdomain
- New Hacker Tools
- Pentest Tools Online
- Hacking Tools Windows 10
- Pentest Tools For Ubuntu
- Tools 4 Hack
- Hacker Techniques Tools And Incident Handling
- Blackhat Hacker Tools
- Hacking Tools For Games
- Hacker Tools Windows
- Top Pentest Tools
- Hacking Tools Online
- Hacking Tools For Beginners
- Hacker Tool Kit
- Hack Tools Online
- Pentest Reporting Tools
- Hacker Techniques Tools And Incident Handling
- Hacker Techniques Tools And Incident Handling
- Hacker Tools Apk
- Hacking Tools For Mac
- How To Hack
- Top Pentest Tools
- Tools Used For Hacking
- Github Hacking Tools
- Pentest Automation Tools
- Ethical Hacker Tools
- Hack Tools
- Hacker Tools Windows
- Hack Apps
- Pentest Tools Website
- Beginner Hacker Tools
- Hacking Tools For Mac
- Hack Website Online Tool
- Growth Hacker Tools
- Underground Hacker Sites
- Pentest Tools Url Fuzzer
- Hacker Tools 2019
- Hacking Tools
- Hack Tools For Mac
- Hack And Tools
- Pentest Tools Website
- Hacking Tools Pc
- Hacking Tools Pc
- Hack Apps
- Best Pentesting Tools 2018
- Pentest Tools Apk
- Pentest Tools Kali Linux
- Pentest Tools Port Scanner
- Hack Rom Tools
- Underground Hacker Sites
- Hacks And Tools
- Hacker Tools 2019
- Hacking Tools Usb
- Hacker Tools Free Download
- Pentest Tools Alternative
- Tools Used For Hacking
- Hacking Tools For Windows Free Download
- Hacker Tools
- Pentest Tools Android
- Hacker Tools Free
- New Hacker Tools
- Hack Tools For Games
- Pentest Tools Free
- Physical Pentest Tools
- Hacking Tools
- Hacking Tools Software
- Free Pentest Tools For Windows
- Nsa Hack Tools
- What Are Hacking Tools
- Pentest Tools Download
- Pentest Tools
- Hacking Tools For Pc
- World No 1 Hacker Software
- Hack Tools For Mac
- Hacker Tools Hardware
- Pentest Tools Free
- Easy Hack Tools
- Hacking Tools Pc
- New Hack Tools
- Hacking Tools Github
- Underground Hacker Sites
- Nsa Hack Tools Download
- Pentest Tools
- Hacking Tools 2020
- Pentest Tools Online
- Easy Hack Tools
- Hacker Tools Online
- Hack Tool Apk No Root
- Computer Hacker
- Tools Used For Hacking
- Hacker Techniques Tools And Incident Handling
- Game Hacking
- Pentest Tools Android
- Growth Hacker Tools
- Nsa Hack Tools Download
- How To Make Hacking Tools
- Hacking Tools Name
- Pentest Tools List
- Hacking Tools Software
- Hacker Security Tools
- Hacker Tools Free
- Hacking Tools Github
- How To Hack
- Hacking Tools Windows 10
- Hacker Tools For Ios
- Hacking Tools And Software
- Pentest Tools Subdomain
- Hack Tool Apk
- Hacking Tools
- Computer Hacker
- Hackers Toolbox
- Hack App
- Tools For Hacker
- Pentest Tools Windows
- Hack Tool Apk
- Hacking Tools Download
- Hack Tools Pc
- Hacker Tools Free Download
- Best Hacking Tools 2020
No comments:
Post a Comment