Are your SSL Secure ? Protect it against MITM SSL Attack

[Batu69]

SSL is a great way to encrypt and protect data transferred between servers or between browser and servers from any attempt to spy on the data on its way or as known as man in the middle attack, we will focus in this article on HTTPS protocol and the method to attack it and proper way to fight against this attacks.

Is HTTPS that important ?

first let’s declare the importance of using SSL with HTTP traffic. Imagine the next scenario. you are trying to login to your bank account with your laptop connected in your wifi and you know its secure its you and your little sister who connect in the same wifi, secure right? ?

but your wifi uses weak password or vulnerable to exploits, so someone gain access to the same wifi and with a simple tool he can run a packet sniffer and catch all your and your sister’s traffic and look into your password and even change the data if he wants.

 

 

Imaging the same scenario but your bank is using HTTPS, when you access the website you receive the website certificate signed and your browser validate the signature to make sure that certificate belongs to the website, then your browser encrypt all data then send the encrypted data to the server and do it vice versa, so if our attacker try to sniff the data all what he will get is the encrypted data, cool right ?

 

Lets be honest no one is 100% secure and SSL had a tough couple of years from attacks like Heartblead, DROWN and POODLE , this attacks target the SSL it self , all what you have to do to mitigate this attacks is to be up to date always and apply vendors patches as it appears.

 

But what about sniffing dangerous, does using HTTPS solve it? the answer is not completely, some researchers tried to sniff HTTPS packages by inventing tools like SSL sniff and SSL strip.

SSL sniff :-

SSL sniff is tool programmed by Moxie Marlinspike based on vulnerability he discovered, let us quickly describe it.

When you request a website for example ( example.com ) as we said before you receive the example.com certificate the certificate must be issued by one of the valid vendors, so if follow certificate chain from the root certificate ( root certificate embedded in the browsers by default) to the leaf certificate ( example.com certificate)

but what if leaf certificate tried to generate another certificate in the chain? lets  say to website like paypal.com! the surprising thing that it worked and no one bothered himself by checking that leaf certificate generated another leaf certificate, but how attacker can use this? the website still be example.com not paypal.com, and that’s why he made SSL Sniff tool.

 

 

by intercepting the traffic (man in the middle attack) you will intercept the request to paypal.com and with SSL Sniff, then you can generate the paypal.com certificate from the leaf certificate you have example.com and send it back to the browser instead of original paypal.com certificate, when the browser try to validate the certificate it will pass because the chain is correct, then any request between the browser and the server will be signed by the certificate you generate so you can decrypt the data as you want, and then re-transfer it by using the original paypal.com certificate, Boom.

fortunately it had been fixed and now the leaf certificate cannot generate another certificate.

SSL Strip:-

Another tool by the same man Moxie Marlinspike. but in this time he came up with another trick using man in the middle, but what if he changed the request to http instead of HTTPS, and he will request the website on behalf of the user using HTTPS but between the attacker and the user its plain http, and the user will not be so suspicious to notice the difference in his browser.

 

How to defend against this techniques ?

Using HTTPS only will not solve it completely, even if you restricted the connection to HTTPS only in the server side, the attacker still can force user to use HTTP by using SSL strip and you will not notice the request still HTTPS in your end, and here HSTS header comes.

 

HTTP Strict Transport Security (HSTS)  is a web security policy mechanism it tells the browser that he must only connect to the website using secure HTTPS connection.

just send header like this from your server.

Strict-Transport-Security: max-age=31536000

The key is Strict-Transport-Security that tells the browser or any other agent to strict the transportation to ssl . the value is maximum age to use this header in seconds 31536000 equal to one non-leap year.

 

Then the user agent will automatically change any url to HTTPS before it send it to the server allowing only secure connections.

Bottom line , using HTTPS comes with responsibilities , you must be up to date , patch your system if any vulnerability comes up, renew your certificate on time and don’t forget to use Strict-Transport-Security Policy.

 

Article source

[truemate]

oh screw this ssl..

 

http://www.nsaneforums.com/topic/273280-solved-many-sites-r-not-opening-not-even-google/?page=1

[Ice Frog]

31 minutes ago, truemate said:

oh screw this ssl..

 

http://www.nsaneforums.com/topic/273280-solved-many-sites-r-not-opening-not-even-google/?page=1

that is the fault of the software not of the technology.

[truemate]

16 hours ago, Ice Frog said:

that is the fault of the software not of the technology.

 

and the software based on that technology/theory !