ALPACA: Application Layer Protocol Confusion-Analyzing And Mitigating Cracks In TLS Authentication

In cooperation with the university Paderborn and Münster University of Applied Sciences, we discovered a new flaw in the specification of TLS. The vulnerability is called ALPACA and exploits a weakness in the authentication of TLS for cross-protocol attacks. The attack allows an attacker to steal cookies or perform cross-site-scripting (XSS) if the specific conditions for the attack are met.

TLS is an internet standard to secure the communication between servers and clients on the internet, for example that of web servers, FTP servers, and Email servers. This is possible because TLS was designed to be application layer independent, which allows its use in many diverse communication protocols.

ALPACA is an application layer protocol content confusion attack, exploiting TLS servers implementing different protocols but using compatible certificates, such as multi-domain or wildcard certificates. Attackers can redirect traffic from one subdomain to another, resulting in a valid TLS session. This breaks the authentication of TLS and cross-protocol attacks may be possible where the behavior of one protocol service may compromise the other at the application layer.

We investigate cross-protocol attacks on TLS in general and conducted a systematic case study on web servers, redirecting HTTPS requests from a victim's web browser to SMTP, IMAP, POP3, and FTP servers. We show that in realistic scenarios, the attacker can extract session cookies and other private user data or execute arbitrary JavaScript in the context of the vulnerable web server, therefore bypassing TLS and web application security.

We evaluated the real-world attack surface of web browsers and widely-deployed Email and FTP servers in lab experiments and with internet-wide scans. We find that 1.​4M web servers are generally vulnerable to cross-protocol attacks, i.e., TLS application data confusion is possible. Of these, 114k web servers can be attacked using an exploitable application server. As a countermeasure, we propose the use of the Application Layer Protocol Negotiation (ALPN) and Server Name Indication (SNI) extensions in TLS to prevent these and other cross-protocol attacks.

Although this vulnerability is very situational and can be challenging to exploit, there are some configurations that are exploitable even by a pure web attacker. Furthermore, we could only analyze a limited number of protocols, and other attack scenarios may exist. Thus, we advise that administrators review their deployments and that application developers (client and server) implement countermeasures proactively for all protocols.

More information on ALPACA can be found on the website https://alpaca-attack.com/.

More info

1. Hack Tool Apk
2. Pentest Tools Website Vulnerability
3. Easy Hack Tools
4. Hacker Tools Online
5. Pentest Tools Port Scanner
6. Hack Tools 2019
7. Underground Hacker Sites
8. Hacker
9. Pentest Tools Url Fuzzer
10. Hackrf Tools
11. Pentest Tools Subdomain
12. Hack Tools For Games
13. Hacker Tools For Pc
14. Tools For Hacker
15. Hacking Tools Free Download
16. Hacking Tools
17. Hacker Tools Apk
18. Hack Tools Mac
19. Install Pentest Tools Ubuntu
20. Pentest Tools Download
21. Computer Hacker
22. Hacking Apps
23. Pentest Tools Website Vulnerability
24. Pentest Box Tools Download
25. Pentest Tools Kali Linux
26. Hacking Tools
27. Pentest Tools Linux
28. Growth Hacker Tools
29. Hack Tools Mac
30. Pentest Tools Website Vulnerability
31. Kik Hack Tools
32. Hacker Tools For Windows
33. Hack App
34. Bluetooth Hacking Tools Kali
35. Physical Pentest Tools
36. Pentest Tools Review
37. Hacking Tools For Pc
38. Hack Tools Mac
39. Hack Tools For Mac
40. Pentest Recon Tools
41. Install Pentest Tools Ubuntu
42. Hack Tools
43. Hacker Search Tools
44. Nsa Hack Tools
45. Pentest Recon Tools
46. Best Hacking Tools 2019
47. Hacker
48. How To Make Hacking Tools
49. Nsa Hack Tools
50. Pentest Tools Port Scanner
51. Hacking Tools For Windows 7
52. Pentest Tools Linux
53. Hacking Tools Windows 10
54. Hack And Tools
55. Hak5 Tools
56. Hacking Tools For Pc
57. Hack Tool Apk
58. Hacking Tools For Kali Linux
59. How To Hack
60. Hacking Tools Mac
61. Best Hacking Tools 2020
62. Hack Tools For Ubuntu
63. Game Hacking
64. Pentest Tools Github
65. Hack Tools For Pc
66. Hacking Tools For Windows Free Download
67. Hackrf Tools
68. Beginner Hacker Tools
69. Wifi Hacker Tools For Windows
70. Hacker Tools For Ios
71. Game Hacking
72. Hacking Tools For Pc
73. Hacking Tools Github
74. Hacker Tools Apk Download
75. Hack Rom Tools
76. Hacking Tools Github
77. Pentest Tools For Mac