ALPACA: Application Layer Protocol Confusion-Analyzing And Mitigating Cracks In TLS Authentication

In cooperation with the university Paderborn and Münster University of Applied Sciences, we discovered a new flaw in the specification of TLS. The vulnerability is called ALPACA and exploits a weakness in the authentication of TLS for cross-protocol attacks. The attack allows an attacker to steal cookies or perform cross-site-scripting (XSS) if the specific conditions for the attack are met.

TLS is an internet standard to secure the communication between servers and clients on the internet, for example that of web servers, FTP servers, and Email servers. This is possible because TLS was designed to be application layer independent, which allows its use in many diverse communication protocols.

ALPACA is an application layer protocol content confusion attack, exploiting TLS servers implementing different protocols but using compatible certificates, such as multi-domain or wildcard certificates. Attackers can redirect traffic from one subdomain to another, resulting in a valid TLS session. This breaks the authentication of TLS and cross-protocol attacks may be possible where the behavior of one protocol service may compromise the other at the application layer.

We investigate cross-protocol attacks on TLS in general and conducted a systematic case study on web servers, redirecting HTTPS requests from a victim's web browser to SMTP, IMAP, POP3, and FTP servers. We show that in realistic scenarios, the attacker can extract session cookies and other private user data or execute arbitrary JavaScript in the context of the vulnerable web server, therefore bypassing TLS and web application security.

We evaluated the real-world attack surface of web browsers and widely-deployed Email and FTP servers in lab experiments and with internet-wide scans. We find that 1.​4M web servers are generally vulnerable to cross-protocol attacks, i.e., TLS application data confusion is possible. Of these, 114k web servers can be attacked using an exploitable application server. As a countermeasure, we propose the use of the Application Layer Protocol Negotiation (ALPN) and Server Name Indication (SNI) extensions in TLS to prevent these and other cross-protocol attacks.

Although this vulnerability is very situational and can be challenging to exploit, there are some configurations that are exploitable even by a pure web attacker. Furthermore, we could only analyze a limited number of protocols, and other attack scenarios may exist. Thus, we advise that administrators review their deployments and that application developers (client and server) implement countermeasures proactively for all protocols.

More information on ALPACA can be found on the website https://alpaca-attack.com/.

More info

1. Pentest Tools Subdomain
2. Hacker Tools Free
3. Hacker Tools Hardware
4. Beginner Hacker Tools
5. Hacker Tools Free
6. How To Install Pentest Tools In Ubuntu
7. Pentest Tools Github
8. Hak5 Tools
9. Hacking Tools Free Download
10. Pentest Tools Download
11. Best Hacking Tools 2020
12. Hack Tools 2019
13. Hack Apps
14. What Is Hacking Tools
15. Hacking Tools Hardware
16. Pentest Tools Android
17. Tools 4 Hack
18. Kik Hack Tools
19. Hack Tools
20. What Are Hacking Tools
21. Hacking Tools For Kali Linux
22. Hacker Tools For Pc
23. Game Hacking
24. Hacker
25. Hacker Tools Hardware
26. Hacker Tools 2019
27. Pentest Tools Bluekeep
28. Growth Hacker Tools
29. Hacking Tools Free Download
30. Game Hacking
31. Hacker Tools Mac
32. Nsa Hack Tools
33. Tools 4 Hack
34. Android Hack Tools Github
35. Pentest Tools Nmap
36. Hacking Tools Pc
37. Hacker Tools For Ios
38. Game Hacking
39. Tools Used For Hacking
40. New Hack Tools
41. Hacking Tools For Pc
42. Pentest Tools For Mac
43. Pentest Recon Tools
44. Hacking Tools Software
45. Easy Hack Tools
46. Android Hack Tools Github
47. Hack Tools For Mac
48. Hack Tools For Pc
49. Hacking Tools Windows
50. Hacking Tools Software
51. Hacks And Tools
52. Hacker Hardware Tools
53. Easy Hack Tools
54. Hack Rom Tools
55. Hacking Tools Windows
56. Hacker Tools Software
57. Hacking Apps
58. Tools 4 Hack
59. Github Hacking Tools
60. Game Hacking
61. Hacks And Tools