ALPACA: Application Layer Protocol Confusion-Analyzing And Mitigating Cracks In TLS Authentication

In cooperation with the university Paderborn and Münster University of Applied Sciences, we discovered a new flaw in the specification of TLS. The vulnerability is called ALPACA and exploits a weakness in the authentication of TLS for cross-protocol attacks. The attack allows an attacker to steal cookies or perform cross-site-scripting (XSS) if the specific conditions for the attack are met.

TLS is an internet standard to secure the communication between servers and clients on the internet, for example that of web servers, FTP servers, and Email servers. This is possible because TLS was designed to be application layer independent, which allows its use in many diverse communication protocols.

ALPACA is an application layer protocol content confusion attack, exploiting TLS servers implementing different protocols but using compatible certificates, such as multi-domain or wildcard certificates. Attackers can redirect traffic from one subdomain to another, resulting in a valid TLS session. This breaks the authentication of TLS and cross-protocol attacks may be possible where the behavior of one protocol service may compromise the other at the application layer.

We investigate cross-protocol attacks on TLS in general and conducted a systematic case study on web servers, redirecting HTTPS requests from a victim's web browser to SMTP, IMAP, POP3, and FTP servers. We show that in realistic scenarios, the attacker can extract session cookies and other private user data or execute arbitrary JavaScript in the context of the vulnerable web server, therefore bypassing TLS and web application security.

We evaluated the real-world attack surface of web browsers and widely-deployed Email and FTP servers in lab experiments and with internet-wide scans. We find that 1.​4M web servers are generally vulnerable to cross-protocol attacks, i.e., TLS application data confusion is possible. Of these, 114k web servers can be attacked using an exploitable application server. As a countermeasure, we propose the use of the Application Layer Protocol Negotiation (ALPN) and Server Name Indication (SNI) extensions in TLS to prevent these and other cross-protocol attacks.

Although this vulnerability is very situational and can be challenging to exploit, there are some configurations that are exploitable even by a pure web attacker. Furthermore, we could only analyze a limited number of protocols, and other attack scenarios may exist. Thus, we advise that administrators review their deployments and that application developers (client and server) implement countermeasures proactively for all protocols.

More information on ALPACA can be found on the website https://alpaca-attack.com/.

Related word

1. Pentest Tools Review
2. Hacking Tools For Kali Linux
3. Pentest Tools Kali Linux
4. Pentest Tools For Mac
5. Pentest Tools Review
6. Hacking Tools For Pc
7. Hack Tools Github
8. Hacker Tools For Ios
9. Best Pentesting Tools 2018
10. Hacker Tools For Ios
11. Pentest Tools Nmap
12. Pentest Tools Android
13. Hacking Tools Kit
14. Underground Hacker Sites
15. Pentest Tools Website
16. Hacking Tools Github
17. Physical Pentest Tools
18. Pentest Tools Port Scanner
19. Tools Used For Hacking
20. Hacking Tools For Games
21. Pentest Tools Open Source
22. Pentest Tools Tcp Port Scanner
23. Hack Tools For Ubuntu
24. Easy Hack Tools
25. Hacking Tools Free Download
26. World No 1 Hacker Software
27. Pentest Tools Open Source
28. Best Hacking Tools 2019
29. Ethical Hacker Tools
30. Pentest Tools Tcp Port Scanner
31. Pentest Tools Subdomain
32. Hack Tools
33. Pentest Tools Bluekeep
34. Hacking Tools Windows
35. Pentest Tools Website Vulnerability
36. Pentest Tools Website
37. Pentest Tools Windows
38. Hacker Tool Kit
39. Hacker Hardware Tools
40. Hacking Tools For Mac
41. Install Pentest Tools Ubuntu
42. Tools 4 Hack
43. Hacker Techniques Tools And Incident Handling
44. Hacker Tools For Mac
45. Hacks And Tools
46. Hak5 Tools
47. Pentest Tools Download
48. Pentest Tools Free
49. Hacking Tools For Kali Linux
50. Ethical Hacker Tools
51. Blackhat Hacker Tools
52. Hacker Security Tools
53. Pentest Tools For Ubuntu
54. Termux Hacking Tools 2019
55. Hacking Tools Hardware
56. Hacking Tools For Pc
57. Hacking Tools Online
58. Hack Tools For Pc
59. Hack Tools For Windows
60. Pentest Tools
61. Pentest Tools Bluekeep
62. Hacking Tools For Games
63. Hacker Tool Kit
64. Hacker Tools Free Download
65. Hacker Tools 2020
66. Hack Tools For Windows
67. Tools 4 Hack
68. Hacking Tools 2020
69. Pentest Tools Subdomain
70. Hacker Tools Hardware
71. Hacking Tools Usb
72. New Hacker Tools
73. Hacking Tools Download
74. Hack Tools Pc
75. Install Pentest Tools Ubuntu
76. Github Hacking Tools
77. Pentest Tools Online