Tag Info

Here are my recommendations for what users can to defend themselves against SSLstrip, Firesheep, and similar attacks: Install HTTPS Everywhere or ForceTLS. (HTTPS Everywhere is easier to use.) This tells your browser to use the SSL versions of web sites, where possible. If the browser gives you a certificate warning, do not bypass the warning, and do not ...

IIRC, SSLStrip does not do a traditional SSL-MITM attack. What it does is watch HTTP traffic, look for links and redirects to HTTPS traffic, and rewrite those links/redirects to HTTP. A quick look at their website confirms this. So, you must have some non-ssl page which links/redirects to an ssl page. SSLStrip sees that and changes the link/redirect to a ...

Google Chrome browser uses preloaded HSTS list. Firefox 17 (most recent release) also added support for the list. It is the same list that Google Chrome uses. HSTS, along with having HTTPS only website are best mitigations against such an attack. Your HTTP website should only permanently redirect to HTTPS and not provide any content.

If you're talking about Moxie's "sslstrip" attack, it's more of a user-oriented attack than an actual technical attack on SSL. It doesn't break the underlying cryptography or trust model. (He has another tool, sslsniff, which actually does attack some of the technical implementations of trust and certificate checking.) First of all, you should watch his ...

You can also use NoScript to ensure your connections are over https. NoScript also comes with a tonne of other defences that include XSS protection, Clickjacking detection, ABE (kinda like a firewall in your browser) and many more. NoScript has been around for years and it's highly regarded and respected.

Checking correct usage of HTTPS is ultimately the sole responsibility of the user. The users need to look at at least 3 points when visiting a web-page: Are they expecting HTTPS to be used (at least for this part of the site)? If so, is the certificate valid (lock/green/blue bar, without warning)? If so, is the host name in the address bar that of the site ...

No. Lack of HTTPS on the home page won't prevent SSLStrip. If any of the connection is transmitted in plain text (ie HTTP), it can be sniffed, and the session could potentially be hijacked. HTTPS should be used for all pages that need to be secured, and HSTS Headers should be employed.

As I replied before, you should understand that you can still use SSLstrip against HTTPS Everywhere. By searching a bit, I also came across this link and this test (related to the previous link), it seems that HTTPSEverywhere does not protect you against spoofing attacks. Related to this topic, I could also find this one which contains a lot of good ...

SSL Strip only works against some sites: sites that use both HTTP and HTTPS. For instance, it works against Amazon, where the main page is over HTTP, but then it transfers to HTTPS for the purchase. SSL Strip will work against Amazon. SSL Strip does not work against purely SSL-only sites. To defend against SSL Strip: Use SSL sitewide. In other words, ...

Keep everything encrypted with SSL with a properly signed SSL certificate from a trusted CA. Web servers/certificate authorities should not give away their private SSL keys, similarly web browsers should only trust a minimal set of respected certificate authorities. This prevents eavesdroppers from decrypting/altering1 communications. 1 Well they could ...

Using Privoxy rule: echo '{ +redirect{s@http://@https://@} } .foo.org' >> /etc/privoxy/user.action will redirect you to HTTPS if a site is whitelisted. In the example www.foo.org and foo.org and subdomain.foo.org can only use HTTPS because the proxy redirects it. If there's an SSLStrip mitm then the page would just load and load and load....it ...

Whenever users first go to a http: page on the Web (as opposed to a local file, or a page on a local server), there is the risk that an evil HTTP proxy alter https: links to either: plain http: links https: links to another website, with a similar name (xxx-login.com instead of xxx.com) Any bank with an http: main page that links to an https: login page ...