Tag Info

Hot answers tagged

14

Here are my recommendations for what users can to defend themselves against SSLstrip, Firesheep, and similar attacks: Install HTTPS Everywhere or ForceTLS. (HTTPS Everywhere is easier to use.) This tells your browser to use the SSL versions of web sites, where possible. If the browser gives you a certificate warning, do not bypass the warning, and do not ...


7

You should watch Moxie Marlinspike's talk Defeating SSL using SSLStrip. In short SSLStrip is a type of MITM attack that forces a victim's browser into communicating with an adversary in plain-text over HTTP, and the adversary proxies the modified content from an HTTPS server. To do this, SSLStrip is "stripping" https:// URLs and turning them into http:// ...


6

IIRC, SSLStrip does not do a traditional SSL-MITM attack. What it does is watch HTTP traffic, look for links and redirects to HTTPS traffic, and rewrite those links/redirects to HTTP. A quick look at their website confirms this. So, you must have some non-ssl page which links/redirects to an ssl page. SSLStrip sees that and changes the link/redirect to a ...


5

Google Chrome browser uses preloaded HSTS list. Firefox 17 (most recent release) also added support for the list. It is the same list that Google Chrome uses. HSTS, along with having HTTPS only website are best mitigations against such an attack. Your HTTP website should only permanently redirect to HTTPS and not provide any content.


4

If you're talking about Moxie's "sslstrip" attack, it's more of a user-oriented attack than an actual technical attack on SSL. It doesn't break the underlying cryptography or trust model. (He has another tool, sslsniff, which actually does attack some of the technical implementations of trust and certificate checking.) First of all, you should watch his ...


3

SSL 2.0 is not a vulnerability; it is a protocol which happens to contain structural vulnerabilities, and, as such, should not be allowed. There is a RFC which says just that, and lists the main known deficiencies in SSL 2.0: SSL version 2.0 [SSL2] deficiencies include the following: o Message authentication uses MD5 [MD5]. Most security-aware users ...


3

SSLStrip will work on any browser. This attack will fail to work under Firefox and Chrome for websites protected with HSTS. For example Google.com and gmail.com should not be affected by SSLStrip because of HSTS. Internet Explorer is not complaint with RFC-6797, which describes the HSTS security measure and is therefore more susceptible to attacks like ...


3

You can also use NoScript to ensure your connections are over https. NoScript also comes with a tonne of other defences that include XSS protection, Clickjacking detection, ABE (kinda like a firewall in your browser) and many more. NoScript has been around for years and it's highly regarded and respected.


3

Checking correct usage of HTTPS is ultimately the sole responsibility of the user. The users need to look at at least 3 points when visiting a web-page: Are they expecting HTTPS to be used (at least for this part of the site)? If so, is the certificate valid (lock/green/blue bar, without warning)? If so, is the host name in the address bar that of the site ...


3

No. Lack of HTTPS on the home page won't prevent SSLStrip. If any of the connection is transmitted in plain text (ie HTTP), it can be sniffed, and the session could potentially be hijacked. HTTPS should be used for all pages that need to be secured, and HSTS Headers should be employed.


2

Whenever users first go to a http: page on the Web (as opposed to a local file, or a page on a local server), there is the risk that an evil HTTP proxy alter https: links to either: plain http: links https: links to another website, with a similar name (example-login.com instead of example.com) Any bank with an http: main page that links to an https: ...


2

As I replied before, you should understand that you can still use SSLstrip against HTTPS Everywhere. By searching a bit, I also came across this link and this test (related to the previous link), it seems that HTTPSEverywhere does not protect you against spoofing attacks. Related to this topic, I could also find this one which contains a lot of good ...


2

SSL Strip only works against some sites: sites that use both HTTP and HTTPS. For instance, it works against Amazon, where the main page is over HTTP, but then it transfers to HTTPS for the purchase. SSL Strip will work against Amazon. SSL Strip does not work against purely SSL-only sites. To defend against SSL Strip: Use SSL sitewide. In other words, ...


2

I believe there must be some sort of confusion here. You seem to think that Fiddler is some attack/hack/magical tool. To decrypt SSL traffic with Fiddler you either need to possess the session key or you need to install Fiddler's certificate on the device. Asking for an attack vector and talking about using Fiddler in the same question sounds silly. You're ...


1

SSLstrip works by listening for https traffic and redirecting it to http. For one thing Skype does not use http it uses its own proprietary protocol. For another they do not offer a non-encrypted version of their protocol the way https does with http so the concept of an SSLstrip type attack will not work. For those reasons SSLstrip will not work against ...


1

Keep everything encrypted with SSL with a properly signed SSL certificate from a trusted CA. Web servers/certificate authorities should not give away their private SSL keys, similarly web browsers should only trust a minimal set of respected certificate authorities. This prevents eavesdroppers from decrypting/altering1 communications. 1 Well they could ...


1

IIRC you should get a warning when going over HTTPS that the certificate has a mismatch, unless you have the real certificate. SSLstrip rewrotes HTTPS to clear HTTP apparently. Also why would SSL strip use a "rogue" public key ? It uses the public key of the website. There is a way to secure yourself, but your browser needs to support it. (read down) ...


1

Using Privoxy rule: echo '{ +redirect{s@http://@https://@} } .foo.org' >> /etc/privoxy/user.action will redirect you to HTTPS if a site is whitelisted. In the example www.foo.org and foo.org and subdomain.foo.org can only use HTTPS because the proxy redirects it. If there's an SSLStrip mitm then the page would just load and load and load....it ...



Only top voted, non community-wiki answers of a minimum length are eligible