5

I saw this video in which the guy talks about ways to defeat SSL. But the video is 4 years old. I wanted to know if these attacks are relevant even now, or some updates have been made to tackle these.

The two different attacks(or tools) he talked about in the video are

  • SSL-Strip: Its like man in the middle in certificate chain or in some cases without certificate chain. It can work by taking advantage of null-prefixed certificates.
  • SSL-Sniff: Monitors the transition/redirection of webpage from http to https version.

I guess SSL-Strip attack should be relevant even now. I am a newbie to the ssl protocol, so forgive me if I have a wrong understanding of it. Any good reading materials on the same would be appreciated.

10
  • sslstrip: This is a downgrade attack, i.e. browser is forced to use insecure HTTP instead of HTTPS. It is still possible, but can be mitigated by the server with HSTS, at least for supported browsers. Most current browsers support it, see caniuse.com for more details.
  • sslsniff: This is a man-in-the-middle attack. The browsers detected this already 4 years ago but now have mostly more strict warnings and when combined with HSTS the browser will not allow bypass of this warning anymore.

Any good reading materials on the same would be appreciated.

For more details about mitigation techniques and their limits read about HSTS, HPKP and how these techniques helped to detect real attacks.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.