Tag Info

Hot answers tagged

18

You should watch Moxie Marlinspike's talk Defeating SSL using SSLStrip. In short SSLStrip is a type of MITM attack that forces a victim's browser into communicating with an adversary in plain-text over HTTP, and the adversary proxies the modified content from an HTTPS server. To do this, SSLStrip is "stripping" https:// URLs and turning them into http:// ...


15

Here are my recommendations for what users can to defend themselves against SSLstrip, Firesheep, and similar attacks: Install HTTPS Everywhere or ForceTLS. (HTTPS Everywhere is easier to use.) This tells your browser to use the SSL versions of web sites, where possible. If the browser gives you a certificate warning, do not bypass the warning, and do not ...


8

There is no new version of sslstrip since 2011 and the feature is already there. How It works: First you need to know about the HSTS headers. SSLStrip will work when server sends HSTS header for the first time and you intercept the traffic in between don't allow the header to reach to the client. The important header field of HSTS that allows client to ...


7

Yes, without further measures, the attacker still can perform SSLStrip. For SSLStrip to work, the attacker only needs to be a man in the middle, unrelated from your behaviour regarding HTTP. On an incoming HTTP request, the attacker would open an HTTPS connection to the real server, and "strip" the SSL off the HTTPS. So, there would be no HTTP communication ...


6

IIRC, SSLStrip does not do a traditional SSL-MITM attack. What it does is watch HTTP traffic, look for links and redirects to HTTPS traffic, and rewrite those links/redirects to HTTP. A quick look at their website confirms this. So, you must have some non-ssl page which links/redirects to an ssl page. SSLStrip sees that and changes the link/redirect to a ...


5

Google Chrome browser uses preloaded HSTS list. Firefox 17 (most recent release) also added support for the list. It is the same list that Google Chrome uses. HSTS, along with having HTTPS only website are best mitigations against such an attack. Your HTTP website should only permanently redirect to HTTPS and not provide any content.


5

SSL 2.0 is not a vulnerability; it is a protocol which happens to contain structural vulnerabilities, and, as such, should not be allowed. There is a RFC which says just that, and lists the main known deficiencies in SSL 2.0: SSL version 2.0 [SSL2] deficiencies include the following: o Message authentication uses MD5 [MD5]. Most security-aware users ...


4

No, that is not possible. In case the user types 'https://', the secure tunnel is generated, and SSLStrip cannot interfere anymore. SSLStrip works by intercepting HTTPS redirects sent from the server. SSLstrip then sets up a HTTPS connection with the server (the server thus thinks everything is ok), but keeps an HTTP connection with the victim. SSLStrip ...


4

Checking correct usage of HTTPS is ultimately the sole responsibility of the user. The users need to look at at least 3 points when visiting a web-page: Are they expecting HTTPS to be used (at least for this part of the site)? If so, is the certificate valid (lock/green/blue bar, without warning)? If so, is the host name in the address bar that of the site ...


4

If you're talking about Moxie's "sslstrip" attack, it's more of a user-oriented attack than an actual technical attack on SSL. It doesn't break the underlying cryptography or trust model. (He has another tool, sslsniff, which actually does attack some of the technical implementations of trust and certificate checking.) First of all, you should watch his ...


4

SSLStrip will work on any browser. This attack will fail to work under Firefox and Chrome for websites protected with HSTS. For example Google.com and gmail.com should not be affected by SSLStrip because of HSTS. Internet Explorer is not complaint with RFC-6797, which describes the HSTS security measure and is therefore more susceptible to attacks like ...


3

You can also use NoScript to ensure your connections are over https. NoScript also comes with a tonne of other defences that include XSS protection, Clickjacking detection, ABE (kinda like a firewall in your browser) and many more. NoScript has been around for years and it's highly regarded and respected.


3

No. Lack of HTTPS on the home page won't prevent SSLStrip. If any of the connection is transmitted in plain text (ie HTTP), it can be sniffed, and the session could potentially be hijacked. HTTPS should be used for all pages that need to be secured, and HSTS Headers should be employed.


3

Whenever users first go to a http: page on the Web (as opposed to a local file, or a page on a local server), there is the risk that an evil HTTP proxy alter https: links to either: plain http: links https: links to another website, with a similar name (example-login.com instead of example.com) Any bank with an http: main page that links to an https: ...


2

As I replied before, you should understand that you can still use SSLstrip against HTTPS Everywhere. By searching a bit, I also came across this link and this test (related to the previous link), it seems that HTTPSEverywhere does not protect you against spoofing attacks. Related to this topic, I could also find this one which contains a lot of good ...


2

SSL Strip only works against some sites: sites that use both HTTP and HTTPS. For instance, it works against Amazon, where the main page is over HTTP, but then it transfers to HTTPS for the purchase. SSL Strip will work against Amazon. SSL Strip does not work against purely SSL-only sites. To defend against SSL Strip: Use SSL sitewide. In other words, ...


2

SSLStrip can work of one of two ways: It will transparently hijack HTTP traffic on a network, watch for HTTPS links and redirects, then map those links into either look-alike HTTP links or homograph-similar HTTPS links. The video is talking about the latter. So you can still use HTTPS, but try to fool the victim into going to ...


2

I believe there must be some sort of confusion here. You seem to think that Fiddler is some attack/hack/magical tool. To decrypt SSL traffic with Fiddler you either need to possess the session key or you need to install Fiddler's certificate on the device. Asking for an attack vector and talking about using Fiddler in the same question sounds silly. You're ...


2

If your site only serves content over HTTPS and hard fails on HTTP requests, with no redirect, are you still vulnerable? If the user accidentally enters http://example.com in their address bar instead of https://example.com, sslstrip could still intercept the connection and trick the user. This could also be true of user's following malicious links - ...


2

I'm going to assume that you are talking about HSTS. HSTS is TOFU (Trust on first use). So from the second use onwards, you are protected. But what about that first use? I don't think there's a unified strategy. But here's some ideas: What works today HSTS Preloading: Use a browser that makes use of the HSTS preload lists. (Chrome, Firefox) And hope ...


2

From wiki: The HSTS Policy[2] is communicated by the server to the user agent via a HTTP response header field named "Strict-Transport-Security". HSTS Policy specifies a period of time during which the user agent shall access the server in a secure-only fashion. In short, just trim out this response header field to the browser and it will never know that ...


1

I think this extension is quite simple and generally safe to use for two reasons: Firstly, on Q. When does HTTPS Everywhere protect me? When does it not protect me? section on HTTPS Everywhere website FAQ page HTTPS Everywhere depends entirely on the security features of the individual web sites that you use; it activates those security features, ...


1

sslstrip works by changing all https links to http. It is restricted to HTTP but tools for other protocols might exist or at least are easily doable. These kind of tools don't break the TLS connection but instead enforce a downgrade to an insecure unencrypted connection. How good these kind of tools can work depends a lot on the application and on the ...


1

As per my knowledge the current implementation of SSL/TLS does not have the capability to identify the data is malicious or not during the transmission or before encrypt the data. If its have , kindly do let me know. SSL/TLS is just for transport of the data and has no idea of what the data are for. Therefore it can and will not detect "malicious ...


1

As part of the attack is doing a MITM for all the victims TCP/UDP traffic, as long as the user does not use an https address explicitly, he could be tricked. For example: if a victim tries to go to "mail.google.com" and trusts the automatic redirect Google does from the http to https (try it for yourself), and he does not check the address bar gots the ...


1

Can an attacker intercept your HTTPS request and perform the request "on your behalf", so-to-speak, and serve your browser an HTTP version If you access an HTTPS site directly (from bookmark for example) then a SSLStrip MITM attack would be highly unlikely. The request would either fail due to the browser looking for a TLS handshake, or prompt you ...


1

SSLstrip works by listening for https traffic and redirecting it to http. For one thing Skype does not use http it uses its own proprietary protocol. For another they do not offer a non-encrypted version of their protocol the way https does with http so the concept of an SSLstrip type attack will not work. For those reasons SSLstrip will not work against ...


1

Keep everything encrypted with SSL with a properly signed SSL certificate from a trusted CA. Web servers/certificate authorities should not give away their private SSL keys, similarly web browsers should only trust a minimal set of respected certificate authorities. This prevents eavesdroppers from decrypting/altering1 communications. 1 Well they could ...


1

IIRC you should get a warning when going over HTTPS that the certificate has a mismatch, unless you have the real certificate. SSLstrip rewrotes HTTPS to clear HTTP apparently. Also why would SSL strip use a "rogue" public key ? It uses the public key of the website. There is a way to secure yourself, but your browser needs to support it. (read down) ...



Only top voted, non community-wiki answers of a minimum length are eligible