Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

I need help understanding the dynamics of an sslstrip attack. I'm using it to test the security of a site that I own. I can successfully sniff the victim (in this case, myself) credentials over the internet but when the same attack happens against Gmail or MSN traffic I get no stuff back. It is completely static in that case. I'm using a go-daddy certificate to secure my ssl exchange.

Does it mean their ssl is secure and mine is not? Like the rogue ssl cert generated by sslstrip is caught and blocked by their ssl cert security and mine is configured in a insecure mode? Do devices like KEMP load balancer do anything to prevent such attacks?

What do I need to do to prevent my site from such attacks? Thanks.

share|improve this question
add comment

2 Answers

up vote 6 down vote accepted

IIRC, SSLStrip does not do a traditional SSL-MITM attack. What it does is watch HTTP traffic, look for links and redirects to HTTPS traffic, and rewrite those links/redirects to HTTP. A quick look at their website confirms this.

So, you must have some non-ssl page which links/redirects to an ssl page. SSLStrip sees that and changes the link/redirect to a non-secured link/redirect. For example, you might have index.php linking to https://domain.com/login.php. SSLstrip changes it to http://domain.com/login.php. You could verify this by typing into your browser https://domain.com/login.php and see if SSLStrip still sees the username and password (or when you click on the login link, see if it has http or https in the url bar in the browser).

You thwart this attack by

  1. Make your site only SSL.
  2. For whatever webserver you use (Apache, IIS, etc), there should be a way to force certain directories to only be accessable over SSL connections. Make all authenticated content SSL-only. A simple google search should reveal how to do this for a given piece of server software.
share|improve this answer
3  
Suggestion 2. problematic, since the attacker can use https to access the server, but still present it as http to the user. –  CodesInChaos Jan 25 '12 at 15:01
    
@CodeInChaos, agreed, but the attack you are talking about is completely different from what SSLStrip does, and the question is about thwarting SSLStrip. –  mikeazo Jan 25 '12 at 17:17
    
@mikeazo but sslstrip could easily be modified to use the HTTPS page –  curiousguy Jun 26 '12 at 4:44
add comment

IIRC you should get a warning when going over HTTPS that the certificate has a mismatch, unless you have the real certificate.

SSLstrip rewrotes HTTPS to clear HTTP apparently.

Also why would SSL strip use a "rogue" public key ? It uses the public key of the website.

There is a way to secure yourself, but your browser needs to support it. (read down)

The reason why it doesn't work is because you are probably doing it with Chrome or Firefox or any other major browser. They use HTTP Strict Transport Security.

It has two properties :

  1. Automatically turn any insecure links to the website into secure links. (For instance, http://example.com/some/page/ will be modified to https://example.com/some/page/ before accessing the server.)
  2. If the security of the connection cannot be ensured (e.g. the server's TLS certificate is self-signed), show an error message and do not allow the user to access the site.
share|improve this answer
    
Thanks for your help. I made an error in the public key comment you are right since the attacker posses itself as rogue CA and generates a public key on its behalf so anything encrypted using 'his' public key would automatically gets decrypted on his end in the man in middle attack. –  Saladin Jan 25 '12 at 5:19
    
But this doesn't answer my question i want to know why the same attack doesn't work in gmail or yahoo scenario? Why they are protected and not me. –  Saladin Jan 25 '12 at 5:20
    
updated my answer –  Lucas Kauffman Jan 25 '12 at 6:44
2  
SSLStrip doesn't do an SSL MitM attack. It does a MitM attack on normal HTTP connections and watches for links/redirects to HTTPS pages and rewrites them as HTTP links/redirects. –  mikeazo Jan 25 '12 at 12:34
1  
@user970533, SSLStrip does not do anything with certificates AFAIK. –  mikeazo Jan 25 '12 at 17:19
show 8 more comments

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.