ALPACA: Application Layer Protocol Confusion-Analyzing And Mitigating Cracks In TLS Authentication

In cooperation with the university Paderborn and Münster University of Applied Sciences, we discovered a new flaw in the specification of TLS. The vulnerability is called ALPACA and exploits a weakness in the authentication of TLS for cross-protocol attacks. The attack allows an attacker to steal cookies or perform cross-site-scripting (XSS) if the specific conditions for the attack are met.

TLS is an internet standard to secure the communication between servers and clients on the internet, for example that of web servers, FTP servers, and Email servers. This is possible because TLS was designed to be application layer independent, which allows its use in many diverse communication protocols.

ALPACA is an application layer protocol content confusion attack, exploiting TLS servers implementing different protocols but using compatible certificates, such as multi-domain or wildcard certificates. Attackers can redirect traffic from one subdomain to another, resulting in a valid TLS session. This breaks the authentication of TLS and cross-protocol attacks may be possible where the behavior of one protocol service may compromise the other at the application layer.

We investigate cross-protocol attacks on TLS in general and conducted a systematic case study on web servers, redirecting HTTPS requests from a victim's web browser to SMTP, IMAP, POP3, and FTP servers. We show that in realistic scenarios, the attacker can extract session cookies and other private user data or execute arbitrary JavaScript in the context of the vulnerable web server, therefore bypassing TLS and web application security.

We evaluated the real-world attack surface of web browsers and widely-deployed Email and FTP servers in lab experiments and with internet-wide scans. We find that 1.​4M web servers are generally vulnerable to cross-protocol attacks, i.e., TLS application data confusion is possible. Of these, 114k web servers can be attacked using an exploitable application server. As a countermeasure, we propose the use of the Application Layer Protocol Negotiation (ALPN) and Server Name Indication (SNI) extensions in TLS to prevent these and other cross-protocol attacks.

Although this vulnerability is very situational and can be challenging to exploit, there are some configurations that are exploitable even by a pure web attacker. Furthermore, we could only analyze a limited number of protocols, and other attack scenarios may exist. Thus, we advise that administrators review their deployments and that application developers (client and server) implement countermeasures proactively for all protocols.

More information on ALPACA can be found on the website https://alpaca-attack.com/.

More information

1. Hacks And Tools
2. Black Hat Hacker Tools
3. Hacking Tools Windows
4. Pentest Tools Github
5. Hacker Tools Apk
6. Hacker Tools Windows
7. Best Hacking Tools 2020
8. Pentest Tools For Ubuntu
9. Pentest Tools List
10. Hacker
11. Hacking Tools Online
12. Hacking Tools Online
13. Hacker Tool Kit
14. Hack Rom Tools
15. Hackrf Tools
16. Hacker Tools Free
17. Hacking Tools 2020
18. Hacker Tools Windows
19. Tools 4 Hack
20. Pentest Tools Nmap
21. Hacking Tools Github
22. Hack Tool Apk
23. Black Hat Hacker Tools
24. Hacking Tools Download
25. Hack Tools For Ubuntu
26. Pentest Tools Subdomain
27. Usb Pentest Tools
28. Ethical Hacker Tools
29. How To Hack
30. Hacking Tools Software
31. Free Pentest Tools For Windows
32. Pentest Tools Kali Linux
33. Game Hacking
34. Pentest Tools List
35. Hack Tools Download
36. Pentest Tools Find Subdomains
37. Hacking Tools For Windows
38. Hacking Tools Mac
39. Pentest Tools Download
40. Tools 4 Hack
41. Pentest Tools For Ubuntu
42. Github Hacking Tools
43. Pentest Tools Website
44. Hacker Tools Apk Download
45. How To Make Hacking Tools
46. Hack Tools Download
47. Hacker
48. Underground Hacker Sites
49. Hacker Tools Free Download
50. Pentest Tools Website
51. Hacker Tools For Mac
52. Hacking Tools Github
53. Hacker Tools Free
54. Pentest Tools Windows
55. Game Hacking
56. World No 1 Hacker Software
57. Tools 4 Hack
58. Best Hacking Tools 2020
59. Pentest Tools Open Source
60. Hacking Apps
61. Pentest Tools Github
62. Hacking Tools Pc
63. Hack Tools
64. Hack Tools Mac
65. Hacking Tools For Mac
66. Hacking Tools Github
67. Hack Tools Pc
68. Hacking Tools Download