Tag Info

Hot answers tagged

15

Here are my recommendations for what users can to defend themselves against SSLstrip, Firesheep, and similar attacks: Install HTTPS Everywhere or ForceTLS. (HTTPS Everywhere is easier to use.) This tells your browser to use the SSL versions of web sites, where possible. If the browser gives you a certificate warning, do not bypass the warning, and do not ...


14

You should watch Moxie Marlinspike's talk Defeating SSL using SSLStrip. In short SSLStrip is a type of MITM attack that forces a victim's browser into communicating with an adversary in plain-text over HTTP, and the adversary proxies the modified content from an HTTPS server. To do this, SSLStrip is "stripping" https:// URLs and turning them into http:// ...


7

Yes, without further measures, the attacker still can perform SSLStrip. For SSLStrip to work, the attacker only needs to be a man in the middle, unrelated from your behaviour regarding HTTP. On an incoming HTTP request, the attacker would open an HTTPS connection to the real server, and "strip" the SSL off the HTTPS. So, there would be no HTTP communication ...


6

There is no new version of sslstrip since 2011 and the feature is already there. How It works: First you need to know about the HSTS headers. SSLStrip will work when server sends HSTS header for the first time and you intercept the traffic in between don't allow the header to reach to the client. The important header field of HSTS that allows client to ...


6

IIRC, SSLStrip does not do a traditional SSL-MITM attack. What it does is watch HTTP traffic, look for links and redirects to HTTPS traffic, and rewrite those links/redirects to HTTP. A quick look at their website confirms this. So, you must have some non-ssl page which links/redirects to an ssl page. SSLStrip sees that and changes the link/redirect to a ...


5

Google Chrome browser uses preloaded HSTS list. Firefox 17 (most recent release) also added support for the list. It is the same list that Google Chrome uses. HSTS, along with having HTTPS only website are best mitigations against such an attack. Your HTTP website should only permanently redirect to HTTPS and not provide any content.


4

SSL 2.0 is not a vulnerability; it is a protocol which happens to contain structural vulnerabilities, and, as such, should not be allowed. There is a RFC which says just that, and lists the main known deficiencies in SSL 2.0: SSL version 2.0 [SSL2] deficiencies include the following: o Message authentication uses MD5 [MD5]. Most security-aware users ...


4

Checking correct usage of HTTPS is ultimately the sole responsibility of the user. The users need to look at at least 3 points when visiting a web-page: Are they expecting HTTPS to be used (at least for this part of the site)? If so, is the certificate valid (lock/green/blue bar, without warning)? If so, is the host name in the address bar that of the site ...


4

If you're talking about Moxie's "sslstrip" attack, it's more of a user-oriented attack than an actual technical attack on SSL. It doesn't break the underlying cryptography or trust model. (He has another tool, sslsniff, which actually does attack some of the technical implementations of trust and certificate checking.) First of all, you should watch his ...


4

SSLStrip will work on any browser. This attack will fail to work under Firefox and Chrome for websites protected with HSTS. For example Google.com and gmail.com should not be affected by SSLStrip because of HSTS. Internet Explorer is not complaint with RFC-6797, which describes the HSTS security measure and is therefore more susceptible to attacks like ...


3

You can also use NoScript to ensure your connections are over https. NoScript also comes with a tonne of other defences that include XSS protection, Clickjacking detection, ABE (kinda like a firewall in your browser) and many more. NoScript has been around for years and it's highly regarded and respected.


3

No. Lack of HTTPS on the home page won't prevent SSLStrip. If any of the connection is transmitted in plain text (ie HTTP), it can be sniffed, and the session could potentially be hijacked. HTTPS should be used for all pages that need to be secured, and HSTS Headers should be employed.


3

Whenever users first go to a http: page on the Web (as opposed to a local file, or a page on a local server), there is the risk that an evil HTTP proxy alter https: links to either: plain http: links https: links to another website, with a similar name (example-login.com instead of example.com) Any bank with an http: main page that links to an https: ...


2

As I replied before, you should understand that you can still use SSLstrip against HTTPS Everywhere. By searching a bit, I also came across this link and this test (related to the previous link), it seems that HTTPSEverywhere does not protect you against spoofing attacks. Related to this topic, I could also find this one which contains a lot of good ...


2

SSL Strip only works against some sites: sites that use both HTTP and HTTPS. For instance, it works against Amazon, where the main page is over HTTP, but then it transfers to HTTPS for the purchase. SSL Strip will work against Amazon. SSL Strip does not work against purely SSL-only sites. To defend against SSL Strip: Use SSL sitewide. In other words, ...


2

I believe there must be some sort of confusion here. You seem to think that Fiddler is some attack/hack/magical tool. To decrypt SSL traffic with Fiddler you either need to possess the session key or you need to install Fiddler's certificate on the device. Asking for an attack vector and talking about using Fiddler in the same question sounds silly. You're ...


2

If your site only serves content over HTTPS and hard fails on HTTP requests, with no redirect, are you still vulnerable? If the user accidentally enters http://example.com in their address bar instead of https://example.com, sslstrip could still intercept the connection and trick the user. This could also be true of user's following malicious links - ...


1

As part of the attack is doing a MITM for all the victims TCP/UDP traffic, as long as the user does not use an https address explicitly, he could be tricked. For example: if a victim tries to go to "mail.google.com" and trusts the automatic redirect Google does from the http to https (try it for yourself), and he does not check the address bar gots the ...


1

Can an attacker intercept your HTTPS request and perform the request "on your behalf", so-to-speak, and serve your browser an HTTP version If you access an HTTPS site directly (from bookmark for example) then a SSLStrip MITM attack would be highly unlikely. The request would either fail due to the browser looking for a TLS handshake, or prompt you ...


1

SSLstrip works by listening for https traffic and redirecting it to http. For one thing Skype does not use http it uses its own proprietary protocol. For another they do not offer a non-encrypted version of their protocol the way https does with http so the concept of an SSLstrip type attack will not work. For those reasons SSLstrip will not work against ...


1

Keep everything encrypted with SSL with a properly signed SSL certificate from a trusted CA. Web servers/certificate authorities should not give away their private SSL keys, similarly web browsers should only trust a minimal set of respected certificate authorities. This prevents eavesdroppers from decrypting/altering1 communications. 1 Well they could ...


1

IIRC you should get a warning when going over HTTPS that the certificate has a mismatch, unless you have the real certificate. SSLstrip rewrotes HTTPS to clear HTTP apparently. Also why would SSL strip use a "rogue" public key ? It uses the public key of the website. There is a way to secure yourself, but your browser needs to support it. (read down) ...


1

Using Privoxy rule: echo '{ +redirect{s@http://@https://@} } .foo.org' >> /etc/privoxy/user.action will redirect you to HTTPS if a site is whitelisted. In the example www.foo.org and foo.org and subdomain.foo.org can only use HTTPS because the proxy redirects it. If there's an SSLStrip mitm then the page would just load and load and load....it ...



Only top voted, non community-wiki answers of a minimum length are eligible