Options when defending against SSLstrip?

Question

I'm wondering, does anyone have any suggestions to defend against SSLstrip particularly?

Answer 1

When you visit SSL secured web site or ssh to host, you accept certificate. If certificate is not validated with public Certificate authority servers, or any local CA, your browser warns you about the wrong certificate. So if you want to secure your traffic from ARP attacks, you have to use valid SSL certificate and don't browse web sites warning about invalid certificate. With SSH, if certificate was changed, SSH will inform you about public key change.

Answer 2

Here are my recommendations for what users can to defend themselves against SSLstrip, Firesheep, and similar attacks:

• Install HTTPS Everywhere or ForceTLS. (HTTPS Everywhere is easier to use.) This tells your browser to use the SSL versions of web sites, where possible.

• If the browser gives you a certificate warning, do not bypass the warning, and do not continue browsing that web site.

• For critical sites, like online banking, go to the HTTPS (SSL) version of the site from your machine while using a secure network, and then bookmark that page. Then, always open the site by opening the bookmark whenever you want to go to that page. Never type its address into the address bar or search bar.

• If you will only be browsing a single site, consider configuring a site-specific browser. This is probably not needed for most purposes, but it will provide additional security against some attacks; it might be appropriate, e.g., for businesses that are using online banking.

• Alternatively, instead of HTTPS Everywhere, you can do your web browsing via a VPN service.

• Configure your email client to use SSL (also known as TLS) and to check the validity of certificates. This will ensure the connection to the email server is encrypted.

Here are my recommendations for what web sites can do to protect their users against Firesheep, SSLstrip, and similar attacks:

• Enable SSL sitewide (i.e., HTTPS).

• Enable HSTS (HTTP Strict Transport Security).

• Make sure that your certificate is valid. Consider buying an Extended Validation (EV) certificate, for more security-critical sites.

• Enable secure cookies, i.e., ensure that all cookies are served with the secure attribute, so that your user's browsers will only send those cookies back over SSL-protected connections and never disclose them over any non-SSL (HTTP) link.

• Disable HTTP (non-SSL) access, or redirect users to the SSL version of the web site.

• Avoid or minimize use of third-party Javascript libraries, widgets, like buttons, etc. Or, if you must use them, make sure they are served from a https: URL and that the site hosting them is one you trust.

On a different topic, administrators of mail servers can protect their users by enabling SSL/TLS protection for IMAP (or, better yet, requiring use of SSL/TLS on all connections) and by enabling STARTTLS on their SMTP servers.

Answer 3

SSLStrip merely redirects to http versions of the page. From the server side, you could introduce things like messages or images that state "your browser has been hijacked" or similar. If you are in a controlled environment this can be handled with an inline transparent web proxy that replaces all http content in this way. Similar to the forcetls etc answer, but handling the problem on the server side. This way, you don't have to worry about pebkac and unauthorised devices. Just a couple of thoughts.

Answer 4

Using Privoxy rule:

echo '{ +redirect{s@http://@https://@} }
.foo.org' >> /etc/privoxy/user.action

will redirect you to HTTPS if a site is whitelisted. In the example www.foo.org and foo.org and subdomain.foo.org can only use HTTPS because the proxy redirects it. If there's an SSLStrip mitm then the page would just load and load and load....it won't be reachable. I think this would be a very good solution (fixme).