ALPACA: Application Layer Protocol Confusion-Analyzing And Mitigating Cracks In TLS Authentication

In cooperation with the university Paderborn and Münster University of Applied Sciences, we discovered a new flaw in the specification of TLS. The vulnerability is called ALPACA and exploits a weakness in the authentication of TLS for cross-protocol attacks. The attack allows an attacker to steal cookies or perform cross-site-scripting (XSS) if the specific conditions for the attack are met.

TLS is an internet standard to secure the communication between servers and clients on the internet, for example that of web servers, FTP servers, and Email servers. This is possible because TLS was designed to be application layer independent, which allows its use in many diverse communication protocols.

ALPACA is an application layer protocol content confusion attack, exploiting TLS servers implementing different protocols but using compatible certificates, such as multi-domain or wildcard certificates. Attackers can redirect traffic from one subdomain to another, resulting in a valid TLS session. This breaks the authentication of TLS and cross-protocol attacks may be possible where the behavior of one protocol service may compromise the other at the application layer.

We investigate cross-protocol attacks on TLS in general and conducted a systematic case study on web servers, redirecting HTTPS requests from a victim's web browser to SMTP, IMAP, POP3, and FTP servers. We show that in realistic scenarios, the attacker can extract session cookies and other private user data or execute arbitrary JavaScript in the context of the vulnerable web server, therefore bypassing TLS and web application security.

We evaluated the real-world attack surface of web browsers and widely-deployed Email and FTP servers in lab experiments and with internet-wide scans. We find that 1.​4M web servers are generally vulnerable to cross-protocol attacks, i.e., TLS application data confusion is possible. Of these, 114k web servers can be attacked using an exploitable application server. As a countermeasure, we propose the use of the Application Layer Protocol Negotiation (ALPN) and Server Name Indication (SNI) extensions in TLS to prevent these and other cross-protocol attacks.

Although this vulnerability is very situational and can be challenging to exploit, there are some configurations that are exploitable even by a pure web attacker. Furthermore, we could only analyze a limited number of protocols, and other attack scenarios may exist. Thus, we advise that administrators review their deployments and that application developers (client and server) implement countermeasures proactively for all protocols.

More information on ALPACA can be found on the website https://alpaca-attack.com/.

Related posts

1. Game Hacking
2. Hackers Toolbox
3. Computer Hacker
4. Hacking Tools Name
5. Hak5 Tools
6. Hacking Tools For Windows Free Download
7. Pentest Tools Free
8. Pentest Tools Website Vulnerability
9. Hacking Tools Github
10. Hacker Tools Free
11. Kik Hack Tools
12. Physical Pentest Tools
13. Pentest Tools Online
14. Pentest Box Tools Download
15. Hacker Tools Apk
16. Hacker Tools Mac
17. Termux Hacking Tools 2019
18. Pentest Tools Online
19. Computer Hacker
20. Best Hacking Tools 2020
21. Hack Tool Apk No Root
22. Hacker Tools For Windows
23. Hacking Tools For Windows Free Download
24. Hacking Tools Kit
25. Pentest Tools
26. Hacker Tools Apk Download
27. Hack Tools For Mac
28. Pentest Tools Online
29. Hacking Tools Name
30. Hack Tool Apk No Root
31. Pentest Tools
32. Hacker Tools 2019
33. Hacking Tools 2020
34. Hacking Tools And Software
35. Top Pentest Tools
36. Hacking Tools Online
37. Hacker Tools Windows
38. Pentest Tools Windows
39. Hacking Tools For Beginners
40. Hacking Tools For Beginners
41. Hack Tools Download
42. Github Hacking Tools
43. Pentest Tools Github
44. Pentest Tools Port Scanner
45. Hacker Tools For Mac
46. Pentest Tools Online
47. Hacking Tools For Windows
48. Pentest Tools Open Source
49. Nsa Hack Tools
50. Hack Rom Tools
51. Hacking Tools 2019
52. Ethical Hacker Tools
53. Pentest Tools For Mac
54. Hacker Tools For Mac
55. Pentest Recon Tools
56. New Hacker Tools
57. Pentest Tools Subdomain
58. Hack Tools 2019
59. Hacker Tools List
60. Tools Used For Hacking
61. Easy Hack Tools
62. Usb Pentest Tools
63. Hack Tools Github
64. Hacking Tools Software
65. Hacking Tools For Windows 7
66. Pentest Recon Tools
67. Pentest Tools Android
68. Black Hat Hacker Tools
69. Hacking Tools For Kali Linux
70. Beginner Hacker Tools
71. Growth Hacker Tools
72. Hacker Hardware Tools
73. Growth Hacker Tools
74. Hacking Tools Usb
75. Pentest Tools Windows
76. Hacks And Tools
77. Hack Apps
78. Hack Tools Mac
79. Hacking Tools For Kali Linux
80. Pentest Automation Tools
81. Hacking Tools Kit
82. Hacker Tools
83. Hack Tool Apk
84. Hacker Tools 2020
85. Pentest Tools Url Fuzzer