In cooperation with the university Paderborn and Münster University of Applied Sciences, we discovered a new flaw in the specification of TLS. The vulnerability is called ALPACA and exploits a weakness in the authentication of TLS for cross-protocol attacks. The attack allows an attacker to steal cookies or perform cross-site-scripting (XSS) if the specific conditions for the attack are met.
TLS is an internet standard to secure the communication between servers and clients on the internet, for example that of web servers, FTP servers, and Email servers. This is possible because TLS was designed to be application layer independent, which allows its use in many diverse communication protocols.
ALPACA is an application layer protocol content confusion attack, exploiting TLS servers implementing different protocols but using compatible certificates, such as multi-domain or wildcard certificates. Attackers can redirect traffic from one subdomain to another, resulting in a valid TLS session. This breaks the authentication of TLS and cross-protocol attacks may be possible where the behavior of one protocol service may compromise the other at the application layer.
We investigate cross-protocol attacks on TLS in general and conducted a systematic case study on web servers, redirecting HTTPS requests from a victim's web browser to SMTP, IMAP, POP3, and FTP servers. We show that in realistic scenarios, the attacker can extract session cookies and other private user data or execute arbitrary JavaScript in the context of the vulnerable web server, therefore bypassing TLS and web application security.
We evaluated the real-world attack surface of web browsers and widely-deployed Email and FTP servers in lab experiments and with internet-wide scans. We find that 1.4M web servers are generally vulnerable to cross-protocol attacks, i.e., TLS application data confusion is possible. Of these, 114k web servers can be attacked using an exploitable application server. As a countermeasure, we propose the use of the Application Layer Protocol Negotiation (ALPN) and Server Name Indication (SNI) extensions in TLS to prevent these and other cross-protocol attacks.
Although this vulnerability is very situational and can be challenging to exploit, there are some configurations that are exploitable even by a pure web attacker. Furthermore, we could only analyze a limited number of protocols, and other attack scenarios may exist. Thus, we advise that administrators review their deployments and that application developers (client and server) implement countermeasures proactively for all protocols.
More information on ALPACA can be found on the website https://alpaca-attack.com/.
More articles- Hacking Apps
- Blackhat Hacker Tools
- Hacker Tools Hardware
- What Is Hacking Tools
- How To Hack
- Hack Tools Online
- Hacking Tools Mac
- Hacker Tools Software
- Kik Hack Tools
- Hacking Tools Usb
- Hacker Tools
- How To Hack
- Nsa Hacker Tools
- Hacking Tools For Windows
- Best Pentesting Tools 2018
- Hacker Hardware Tools
- Pentest Tools Online
- Pentest Tools Bluekeep
- Pentest Tools List
- Bluetooth Hacking Tools Kali
- Nsa Hack Tools Download
- Hacker Tools For Ios
- Hacker Tools
- Hacking Tools For Kali Linux
- Hacking Tools 2020
- Pentest Tools Website
- Hacker Tools Windows
- Hacker Security Tools
- Hacking Tools For Kali Linux
- Pentest Tools Windows
- Hacking Tools Usb
- Best Hacking Tools 2019
- Hack Apps
- Hack Tool Apk
- Tools For Hacker
- Best Hacking Tools 2020
- Tools For Hacker
- Hacker Tool Kit
- Hacking Apps
- Hacking Tools 2019
- Pentest Tools Nmap
- Hack Rom Tools
- Hacker
- Blackhat Hacker Tools
- Pentest Tools Port Scanner
- Hacking Tools For Beginners
- Pentest Tools Url Fuzzer
- Hackers Toolbox
- Hacker Search Tools
- Pentest Tools Apk
- Hacking Tools And Software
- Pentest Tools Port Scanner
- Hacker Tools List
- Hack Tools For Windows
- Hacker Search Tools
- New Hack Tools
- Hack Apps
- Hacking Tools 2019
- Hacking Tools For Windows 7
- Hacker Tools
- Pentest Tools For Mac
- Hacker Tools List
- Hack Tools For Pc
- Termux Hacking Tools 2019
- Pentest Tools Android
- Hacking Tools Download
- Hacking App
- Hacking Apps
- Hacker Tools Apk
- Install Pentest Tools Ubuntu
- Hacker Tools Apk Download
- Pentest Tools Kali Linux
- Usb Pentest Tools
- Hackrf Tools
- Pentest Tools Android
- Hacking Tools For Windows 7
- How To Hack
- Black Hat Hacker Tools
- Hacker Tools For Windows
- Hacking Tools Github
- Tools Used For Hacking
- What Is Hacking Tools
- Pentest Tools Kali Linux
- Hack Rom Tools
- Hacker Tools
- Best Hacking Tools 2020
- Pentest Tools Open Source
- Hacking Tools
- How To Make Hacking Tools
- Hacker Tools Online
- Pentest Tools Website Vulnerability
- Hack Tools For Mac
- Github Hacking Tools
- Pentest Tools Bluekeep
- Hacking Tools Kit
- How To Hack
- New Hack Tools
- Hacker Tools For Pc
- Hack Website Online Tool
- Hack Tool Apk
- Hacker Tool Kit
- Pentest Tools Nmap
- Hacking Tools Mac
- Hacks And Tools
- Hacking Tools
- Hacking Tools Hardware
- Hacking Tools 2020
- Hacking Tools Software
- Hacking App
- Hacker Hardware Tools
- Hacking Tools And Software
- Hacker
- Hack Tools For Games
- Hacker Tools Online
- Pentest Tools Github
- Hacker Techniques Tools And Incident Handling
- Hacking App
- Hack Tools Mac
- Pentest Tools Website Vulnerability
- Hacking Tools For Mac
- Hack Tools
- Pentest Tools Review
- Pentest Tools For Windows
- Hacking Tools Kit
- Top Pentest Tools
- Hak5 Tools
- Pentest Tools Website Vulnerability
- Hacking Tools Usb
- Tools 4 Hack
- Pentest Tools Find Subdomains
- Nsa Hack Tools Download
- Hacking App
- Pentest Tools Url Fuzzer
- Pentest Tools Bluekeep
- Hack Tools Mac
- Pentest Tools
- Hacking Tools Download
- Hacking Tools Github
- Pentest Tools Subdomain
- Hacker Tools For Windows
- Pentest Tools Open Source
- Hacker Security Tools
- Pentest Tools Website
- Nsa Hack Tools