ALPACA: Application Layer Protocol Confusion-Analyzing And Mitigating Cracks In TLS Authentication

In cooperation with the university Paderborn and Münster University of Applied Sciences, we discovered a new flaw in the specification of TLS. The vulnerability is called ALPACA and exploits a weakness in the authentication of TLS for cross-protocol attacks. The attack allows an attacker to steal cookies or perform cross-site-scripting (XSS) if the specific conditions for the attack are met.

TLS is an internet standard to secure the communication between servers and clients on the internet, for example that of web servers, FTP servers, and Email servers. This is possible because TLS was designed to be application layer independent, which allows its use in many diverse communication protocols.

ALPACA is an application layer protocol content confusion attack, exploiting TLS servers implementing different protocols but using compatible certificates, such as multi-domain or wildcard certificates. Attackers can redirect traffic from one subdomain to another, resulting in a valid TLS session. This breaks the authentication of TLS and cross-protocol attacks may be possible where the behavior of one protocol service may compromise the other at the application layer.

We investigate cross-protocol attacks on TLS in general and conducted a systematic case study on web servers, redirecting HTTPS requests from a victim's web browser to SMTP, IMAP, POP3, and FTP servers. We show that in realistic scenarios, the attacker can extract session cookies and other private user data or execute arbitrary JavaScript in the context of the vulnerable web server, therefore bypassing TLS and web application security.

We evaluated the real-world attack surface of web browsers and widely-deployed Email and FTP servers in lab experiments and with internet-wide scans. We find that 1.​4M web servers are generally vulnerable to cross-protocol attacks, i.e., TLS application data confusion is possible. Of these, 114k web servers can be attacked using an exploitable application server. As a countermeasure, we propose the use of the Application Layer Protocol Negotiation (ALPN) and Server Name Indication (SNI) extensions in TLS to prevent these and other cross-protocol attacks.

Although this vulnerability is very situational and can be challenging to exploit, there are some configurations that are exploitable even by a pure web attacker. Furthermore, we could only analyze a limited number of protocols, and other attack scenarios may exist. Thus, we advise that administrators review their deployments and that application developers (client and server) implement countermeasures proactively for all protocols.

More information on ALPACA can be found on the website https://alpaca-attack.com/.

Related word

1. Pentest Box Tools Download
2. Hacking Tools Windows
3. Hacks And Tools
4. Hack Tools Github
5. Pentest Tools Online
6. Usb Pentest Tools
7. Hacking Tools Github
8. Hacking App
9. Hack And Tools
10. Hacker Tools
11. Pentest Tools Linux
12. How To Hack
13. Hacker Tools For Ios
14. Hacking Tools For Mac
15. Pentest Reporting Tools
16. Pentest Tools List
17. Hacking Tools Mac
18. Hacker Tools
19. Hack Tools
20. Pentest Tools Free
21. Hacker Tools Github
22. Pentest Tools Framework
23. Hack Tools For Windows
24. Hacker Search Tools
25. Hacks And Tools
26. Pentest Tools Open Source
27. How To Hack
28. Physical Pentest Tools
29. Nsa Hack Tools Download
30. Hacking Tools 2019
31. Pentest Tools Android
32. World No 1 Hacker Software
33. Pentest Tools Website Vulnerability
34. Hacker Tools Linux
35. Hackers Toolbox
36. Kik Hack Tools
37. Hacking Tools Download
38. Ethical Hacker Tools
39. Pentest Tools For Ubuntu
40. Hacking Tools For Windows 7
41. Hacker Tools Hardware
42. Pentest Tools For Mac
43. Hacking Tools Name
44. New Hack Tools
45. Hacking Tools Name
46. Pentest Tools Website Vulnerability
47. Hacking Tools Pc
48. Hacking Tools Github
49. Pentest Tools Website Vulnerability
50. Hacking App
51. Easy Hack Tools
52. Hacking Tools 2020
53. Android Hack Tools Github
54. Hack Tools For Ubuntu
55. Hacking Tools For Windows Free Download
56. Usb Pentest Tools
57. Hack Tools Pc
58. Hacker Techniques Tools And Incident Handling
59. Pentest Tools Bluekeep
60. Hacker Search Tools
61. Hacking Tools 2019
62. Pentest Tools Windows
63. Pentest Recon Tools