ALPACA: Application Layer Protocol Confusion-Analyzing And Mitigating Cracks In TLS Authentication

In cooperation with the university Paderborn and Münster University of Applied Sciences, we discovered a new flaw in the specification of TLS. The vulnerability is called ALPACA and exploits a weakness in the authentication of TLS for cross-protocol attacks. The attack allows an attacker to steal cookies or perform cross-site-scripting (XSS) if the specific conditions for the attack are met.

TLS is an internet standard to secure the communication between servers and clients on the internet, for example that of web servers, FTP servers, and Email servers. This is possible because TLS was designed to be application layer independent, which allows its use in many diverse communication protocols.

ALPACA is an application layer protocol content confusion attack, exploiting TLS servers implementing different protocols but using compatible certificates, such as multi-domain or wildcard certificates. Attackers can redirect traffic from one subdomain to another, resulting in a valid TLS session. This breaks the authentication of TLS and cross-protocol attacks may be possible where the behavior of one protocol service may compromise the other at the application layer.

We investigate cross-protocol attacks on TLS in general and conducted a systematic case study on web servers, redirecting HTTPS requests from a victim's web browser to SMTP, IMAP, POP3, and FTP servers. We show that in realistic scenarios, the attacker can extract session cookies and other private user data or execute arbitrary JavaScript in the context of the vulnerable web server, therefore bypassing TLS and web application security.

We evaluated the real-world attack surface of web browsers and widely-deployed Email and FTP servers in lab experiments and with internet-wide scans. We find that 1.​4M web servers are generally vulnerable to cross-protocol attacks, i.e., TLS application data confusion is possible. Of these, 114k web servers can be attacked using an exploitable application server. As a countermeasure, we propose the use of the Application Layer Protocol Negotiation (ALPN) and Server Name Indication (SNI) extensions in TLS to prevent these and other cross-protocol attacks.

Although this vulnerability is very situational and can be challenging to exploit, there are some configurations that are exploitable even by a pure web attacker. Furthermore, we could only analyze a limited number of protocols, and other attack scenarios may exist. Thus, we advise that administrators review their deployments and that application developers (client and server) implement countermeasures proactively for all protocols.

More information on ALPACA can be found on the website https://alpaca-attack.com/.

Related news

1. Pentest Tools Online
2. Pentest Tools Website Vulnerability
3. Hacker Search Tools
4. Android Hack Tools Github
5. Pentest Tools For Android
6. Hacking Tools For Pc
7. Pentest Tools Windows
8. Pentest Tools For Android
9. Hacking Tools For Windows Free Download
10. Hacking Tools Name
11. Physical Pentest Tools
12. Hacker Tools Hardware
13. Pentest Tools Online
14. Physical Pentest Tools
15. Growth Hacker Tools
16. Hacker Tools
17. Tools Used For Hacking
18. Hack Tools
19. Hacker Tools Hardware
20. Pentest Automation Tools
21. Hacking Tools For Windows 7
22. Hacking Tools Windows
23. Nsa Hack Tools
24. Hacker Tools Apk
25. Pentest Tools Subdomain
26. Best Pentesting Tools 2018
27. Hacker Tools Mac
28. Hack Tools Github
29. Hacks And Tools
30. Nsa Hack Tools
31. Hacking Tools For Windows 7
32. Hacking Tools Name
33. Best Pentesting Tools 2018
34. What Is Hacking Tools
35. Hacker Tools Linux
36. Hacker Security Tools
37. Hacking Tools For Kali Linux
38. Pentest Tools Download
39. Pentest Tools Alternative
40. Pentest Tools Port Scanner
41. Pentest Tools Github
42. Pentest Tools Kali Linux
43. Pentest Tools Port Scanner
44. Pentest Tools Online
45. Pentest Tools Download
46. New Hacker Tools
47. How To Make Hacking Tools
48. Hack Tools For Windows
49. Hack Tools For Windows
50. Beginner Hacker Tools
51. Hacking Tools Pc
52. Best Hacking Tools 2020
53. Pentest Tools For Ubuntu
54. Hacking Tools For Windows Free Download
55. Hacking Tools Usb
56. Pentest Tools Website
57. Hacking Tools Hardware
58. Pentest Tools Free
59. Hacking Tools Github
60. Hack App
61. Free Pentest Tools For Windows
62. Pentest Automation Tools
63. Pentest Tools Download
64. Hacking Tools Github
65. Hacker Tools Mac
66. Hacking Tools Usb
67. Pentest Box Tools Download
68. Hacking Tools Usb
69. Black Hat Hacker Tools
70. How To Make Hacking Tools
71. How To Make Hacking Tools
72. Pentest Tools Website Vulnerability
73. Kik Hack Tools
74. Hacker Tools
75. Game Hacking
76. What Are Hacking Tools
77. Hack Apps
78. Hack Tools Download
79. Hacker Tools List
80. Pentest Tools Subdomain
81. Hacker Tool Kit
82. Pentest Tools Linux
83. Hacker Tools Apk Download
84. Hack Tools For Games
85. Pentest Automation Tools
86. Hacker Search Tools
87. What Is Hacking Tools
88. Nsa Hacker Tools
89. Pentest Tools For Mac
90. Kik Hack Tools
91. Pentest Tools Review
92. Hack Tools Github
93. Pentest Tools Find Subdomains
94. Hacking Tools
95. Hacker Tools Linux
96. Hacking Tools For Games
97. Beginner Hacker Tools
98. Hack Tool Apk No Root
99. Pentest Tools Github
100. Hack Apps
101. Hacking Tools Name
102. Best Hacking Tools 2019
103. Hack Tools
104. Pentest Recon Tools
105. Hackers Toolbox
106. Computer Hacker
107. Hacking Tools Windows
108. Nsa Hacker Tools
109. Hack Website Online Tool
110. Hacking Tools For Mac