ALPACA: Application Layer Protocol Confusion-Analyzing And Mitigating Cracks In TLS Authentication

In cooperation with the university Paderborn and Münster University of Applied Sciences, we discovered a new flaw in the specification of TLS. The vulnerability is called ALPACA and exploits a weakness in the authentication of TLS for cross-protocol attacks. The attack allows an attacker to steal cookies or perform cross-site-scripting (XSS) if the specific conditions for the attack are met.

TLS is an internet standard to secure the communication between servers and clients on the internet, for example that of web servers, FTP servers, and Email servers. This is possible because TLS was designed to be application layer independent, which allows its use in many diverse communication protocols.

ALPACA is an application layer protocol content confusion attack, exploiting TLS servers implementing different protocols but using compatible certificates, such as multi-domain or wildcard certificates. Attackers can redirect traffic from one subdomain to another, resulting in a valid TLS session. This breaks the authentication of TLS and cross-protocol attacks may be possible where the behavior of one protocol service may compromise the other at the application layer.

We investigate cross-protocol attacks on TLS in general and conducted a systematic case study on web servers, redirecting HTTPS requests from a victim's web browser to SMTP, IMAP, POP3, and FTP servers. We show that in realistic scenarios, the attacker can extract session cookies and other private user data or execute arbitrary JavaScript in the context of the vulnerable web server, therefore bypassing TLS and web application security.

We evaluated the real-world attack surface of web browsers and widely-deployed Email and FTP servers in lab experiments and with internet-wide scans. We find that 1.​4M web servers are generally vulnerable to cross-protocol attacks, i.e., TLS application data confusion is possible. Of these, 114k web servers can be attacked using an exploitable application server. As a countermeasure, we propose the use of the Application Layer Protocol Negotiation (ALPN) and Server Name Indication (SNI) extensions in TLS to prevent these and other cross-protocol attacks.

Although this vulnerability is very situational and can be challenging to exploit, there are some configurations that are exploitable even by a pure web attacker. Furthermore, we could only analyze a limited number of protocols, and other attack scenarios may exist. Thus, we advise that administrators review their deployments and that application developers (client and server) implement countermeasures proactively for all protocols.

More information on ALPACA can be found on the website https://alpaca-attack.com/.

Related posts

1. Hacking Tools Hardware
2. Pentest Tools For Mac
3. Pentest Tools Find Subdomains
4. Hacker Tools Mac
5. Hack Tools For Ubuntu
6. Hacking Tools Windows 10
7. Hacker Tools For Mac
8. Hacking Tools For Windows 7
9. Hack App
10. Black Hat Hacker Tools
11. Pentest Tools List
12. Best Pentesting Tools 2018
13. Hacking Tools For Mac
14. Hacker Tools 2019
15. Hacking Apps
16. Hacking App
17. Usb Pentest Tools
18. Hack Tools For Ubuntu
19. Hacking Tools Software
20. Underground Hacker Sites
21. Hacker Tools For Windows
22. Top Pentest Tools
23. Pentest Tools Free
24. Hacker Tools For Ios
25. Easy Hack Tools
26. Pentest Tools
27. Hacker Tools Online
28. Hacking Tools 2020
29. Hacker Tools List
30. Pentest Tools Subdomain
31. Hacker Techniques Tools And Incident Handling
32. Hack Tools Online
33. What Are Hacking Tools
34. Hackrf Tools
35. Hacking Tools Kit
36. Termux Hacking Tools 2019
37. Hack Tools 2019
38. Hacking Apps
39. Hack Tools Pc
40. Hack Tools For Windows
41. Hack Tools For Windows
42. Hacker Tools For Pc
43. Ethical Hacker Tools
44. Github Hacking Tools
45. Pentest Tools Bluekeep
46. Hacker Tools 2020
47. Wifi Hacker Tools For Windows
48. Hacker Hardware Tools
49. Hack Tools
50. Pentest Box Tools Download
51. Tools 4 Hack
52. Hack Tools Online
53. Hacker Techniques Tools And Incident Handling
54. Pentest Tools For Windows
55. Ethical Hacker Tools
56. Hacking Tools Github
57. Hacking Tools For Games
58. Pentest Tools Android
59. Hacks And Tools
60. Ethical Hacker Tools
61. Pentest Box Tools Download
62. Pentest Tools Find Subdomains
63. Hack Tools 2019
64. Hacker Tools Software
65. Pentest Tools Subdomain
66. Hacking Tools For Kali Linux
67. Hacker Tool Kit
68. Hacking Tools Name
69. Hacker Tools Windows
70. Hack And Tools
71. Wifi Hacker Tools For Windows
72. Pentest Tools For Mac
73. Hacker
74. Hacker Tools For Mac
75. Hacker Tools For Pc
76. Hacker Security Tools
77. Hacking Tools And Software
78. Pentest Automation Tools