ALPACA: Application Layer Protocol Confusion-Analyzing And Mitigating Cracks In TLS Authentication

In cooperation with the university Paderborn and Münster University of Applied Sciences, we discovered a new flaw in the specification of TLS. The vulnerability is called ALPACA and exploits a weakness in the authentication of TLS for cross-protocol attacks. The attack allows an attacker to steal cookies or perform cross-site-scripting (XSS) if the specific conditions for the attack are met.

TLS is an internet standard to secure the communication between servers and clients on the internet, for example that of web servers, FTP servers, and Email servers. This is possible because TLS was designed to be application layer independent, which allows its use in many diverse communication protocols.

ALPACA is an application layer protocol content confusion attack, exploiting TLS servers implementing different protocols but using compatible certificates, such as multi-domain or wildcard certificates. Attackers can redirect traffic from one subdomain to another, resulting in a valid TLS session. This breaks the authentication of TLS and cross-protocol attacks may be possible where the behavior of one protocol service may compromise the other at the application layer.

We investigate cross-protocol attacks on TLS in general and conducted a systematic case study on web servers, redirecting HTTPS requests from a victim's web browser to SMTP, IMAP, POP3, and FTP servers. We show that in realistic scenarios, the attacker can extract session cookies and other private user data or execute arbitrary JavaScript in the context of the vulnerable web server, therefore bypassing TLS and web application security.

We evaluated the real-world attack surface of web browsers and widely-deployed Email and FTP servers in lab experiments and with internet-wide scans. We find that 1.​4M web servers are generally vulnerable to cross-protocol attacks, i.e., TLS application data confusion is possible. Of these, 114k web servers can be attacked using an exploitable application server. As a countermeasure, we propose the use of the Application Layer Protocol Negotiation (ALPN) and Server Name Indication (SNI) extensions in TLS to prevent these and other cross-protocol attacks.

Although this vulnerability is very situational and can be challenging to exploit, there are some configurations that are exploitable even by a pure web attacker. Furthermore, we could only analyze a limited number of protocols, and other attack scenarios may exist. Thus, we advise that administrators review their deployments and that application developers (client and server) implement countermeasures proactively for all protocols.

More information on ALPACA can be found on the website https://alpaca-attack.com/.

Read more

1. Hacking Tools Name
2. Top Pentest Tools
3. Pentest Reporting Tools
4. Hacker Tools Apk Download
5. Tools Used For Hacking
6. Best Pentesting Tools 2018
7. Nsa Hack Tools
8. Hacker Security Tools
9. Hacking Tools Online
10. Pentest Recon Tools
11. Hacker Tools Windows
12. Hacker Tools For Ios
13. Hacker Tools For Mac
14. Best Hacking Tools 2019
15. Pentest Tools Subdomain
16. Hacker Tools Online
17. Hacks And Tools
18. Pentest Tools Website Vulnerability
19. Pentest Tools Free
20. Ethical Hacker Tools
21. Computer Hacker
22. Hacker Tools Free Download
23. Pentest Tools List
24. Hack Rom Tools
25. Hacking Tools Free Download
26. How To Install Pentest Tools In Ubuntu
27. Hacking Tools For Games
28. Pentest Tools Alternative
29. Hacking Tools And Software
30. Pentest Recon Tools
31. What Are Hacking Tools
32. Pentest Tools Android
33. Pentest Tools Apk
34. Hacker Hardware Tools
35. Hack Tools For Ubuntu
36. Hacker Tools Github
37. Hacking Tools For Kali Linux
38. Hack Tools For Windows
39. Pentest Automation Tools
40. Pentest Tools Free
41. What Are Hacking Tools
42. Pentest Tools Github
43. Pentest Tools Review
44. Hacking Tools For Kali Linux
45. Hacker Security Tools
46. Hacker Tools For Pc
47. Blackhat Hacker Tools
48. Hacking Tools For Pc
49. Pentest Automation Tools
50. Pentest Tools For Windows
51. Ethical Hacker Tools
52. Hack Tools Github
53. Github Hacking Tools
54. Usb Pentest Tools
55. Hackrf Tools
56. Pentest Tools
57. Pentest Tools Windows
58. Hacker Tools For Ios
59. Hacking Tools Download
60. Hack Tools Online
61. Hacker Tools Hardware
62. Nsa Hack Tools Download
63. What Is Hacking Tools
64. Pentest Box Tools Download
65. Pentest Tools Nmap
66. Hacker
67. Hack Tools Online
68. Pentest Tools Website
69. Hack Tools
70. Hacker Tools For Pc
71. Hacker Hardware Tools
72. Beginner Hacker Tools
73. Hacker Search Tools
74. Easy Hack Tools
75. Hack Tools For Windows
76. Physical Pentest Tools
77. Hacking Tools Mac
78. Pentest Tools Free
79. Hackrf Tools
80. Pentest Tools Port Scanner
81. Black Hat Hacker Tools
82. Hacking Tools For Windows Free Download
83. Hacking Tools Windows 10
84. Hacking Tools Mac
85. Pentest Recon Tools
86. Hacker Search Tools
87. Hack App
88. Pentest Tools Android
89. Pentest Tools Url Fuzzer
90. Hacking Tools For Kali Linux
91. Pentest Tools Download
92. Tools 4 Hack
93. Hack Tools Pc
94. Pentest Tools Android
95. Growth Hacker Tools
96. Hacker Tools Linux
97. Nsa Hack Tools
98. Hacking Tools For Windows Free Download
99. Best Pentesting Tools 2018
100. Hacking Tools Usb
101. Hacks And Tools
102. Hacker
103. Hacking Tools Mac
104. Pentest Tools Bluekeep
105. World No 1 Hacker Software
106. Hack Tools Github
107. Hacker Tools Online
108. Hack Tools For Mac
109. Hacking Tools For Windows Free Download
110. How To Install Pentest Tools In Ubuntu
111. Hack Tools Github
112. Hacking App