ALPACA: Application Layer Protocol Confusion-Analyzing And Mitigating Cracks In TLS Authentication

In cooperation with the university Paderborn and Münster University of Applied Sciences, we discovered a new flaw in the specification of TLS. The vulnerability is called ALPACA and exploits a weakness in the authentication of TLS for cross-protocol attacks. The attack allows an attacker to steal cookies or perform cross-site-scripting (XSS) if the specific conditions for the attack are met.

TLS is an internet standard to secure the communication between servers and clients on the internet, for example that of web servers, FTP servers, and Email servers. This is possible because TLS was designed to be application layer independent, which allows its use in many diverse communication protocols.

ALPACA is an application layer protocol content confusion attack, exploiting TLS servers implementing different protocols but using compatible certificates, such as multi-domain or wildcard certificates. Attackers can redirect traffic from one subdomain to another, resulting in a valid TLS session. This breaks the authentication of TLS and cross-protocol attacks may be possible where the behavior of one protocol service may compromise the other at the application layer.

We investigate cross-protocol attacks on TLS in general and conducted a systematic case study on web servers, redirecting HTTPS requests from a victim's web browser to SMTP, IMAP, POP3, and FTP servers. We show that in realistic scenarios, the attacker can extract session cookies and other private user data or execute arbitrary JavaScript in the context of the vulnerable web server, therefore bypassing TLS and web application security.

We evaluated the real-world attack surface of web browsers and widely-deployed Email and FTP servers in lab experiments and with internet-wide scans. We find that 1.​4M web servers are generally vulnerable to cross-protocol attacks, i.e., TLS application data confusion is possible. Of these, 114k web servers can be attacked using an exploitable application server. As a countermeasure, we propose the use of the Application Layer Protocol Negotiation (ALPN) and Server Name Indication (SNI) extensions in TLS to prevent these and other cross-protocol attacks.

Although this vulnerability is very situational and can be challenging to exploit, there are some configurations that are exploitable even by a pure web attacker. Furthermore, we could only analyze a limited number of protocols, and other attack scenarios may exist. Thus, we advise that administrators review their deployments and that application developers (client and server) implement countermeasures proactively for all protocols.

More information on ALPACA can be found on the website https://alpaca-attack.com/.

More info

1. Hacking Tools Mac
2. Best Pentesting Tools 2018
3. Hack Website Online Tool
4. Hacking Tools Pc
5. Pentest Automation Tools
6. Usb Pentest Tools
7. Hacking Tools
8. Hacking Tools Software
9. Hacking Tools 2019
10. Hacking Tools For Pc
11. Hack Tools 2019
12. Hack Tools For Windows
13. Hack Tools
14. Hacker Tools For Ios
15. How To Install Pentest Tools In Ubuntu
16. Hacker Techniques Tools And Incident Handling
17. Hacker
18. Pentest Tools Website
19. Bluetooth Hacking Tools Kali
20. Hacking Tools 2019
21. Hacking Tools Online
22. World No 1 Hacker Software
23. New Hacker Tools
24. Pentest Tools Github
25. Pentest Tools Website Vulnerability
26. Hacker Tools For Windows
27. Hacking Tools Windows
28. Hacker Tools List
29. Blackhat Hacker Tools
30. Termux Hacking Tools 2019
31. Pentest Tools Linux
32. Hacking Tools For Windows 7
33. Pentest Tools For Ubuntu
34. Pentest Tools Github
35. Hackrf Tools
36. Tools 4 Hack
37. Hack Tools Mac
38. Hacker Tool Kit
39. Top Pentest Tools
40. Hacking Tools For Mac
41. Bluetooth Hacking Tools Kali
42. Wifi Hacker Tools For Windows
43. Hacking Tools Mac
44. Android Hack Tools Github
45. Hacking Tools Github
46. Pentest Tools Framework
47. Pentest Box Tools Download
48. Blackhat Hacker Tools
49. Pentest Tools Nmap
50. Pentest Tools For Mac
51. Nsa Hack Tools Download
52. Hacking Tools Online
53. Hacking Tools For Beginners
54. Hak5 Tools
55. Hacking Tools 2020
56. Hacking Tools For Windows 7
57. Pentest Tools Bluekeep
58. Easy Hack Tools
59. Pentest Tools Windows
60. Usb Pentest Tools
61. Termux Hacking Tools 2019
62. Pentest Reporting Tools
63. Hacker Tools Windows
64. Pentest Tools Android
65. Pentest Recon Tools
66. Pentest Tools Open Source
67. Pentest Tools For Ubuntu
68. Hacker Tools Github
69. Hack Tools For Windows
70. Bluetooth Hacking Tools Kali
71. Underground Hacker Sites
72. Hack Tools Online
73. Pentest Tools Apk
74. Hack Tool Apk
75. Pentest Tools For Windows
76. Pentest Tools Apk
77. Hacker
78. Pentest Tools Android
79. Pentest Tools Nmap
80. Hacker Tools Linux
81. Hacker Techniques Tools And Incident Handling
82. What Are Hacking Tools
83. Pentest Tools For Mac
84. Hacker Tools List
85. Hacker Tools Apk Download
86. Pentest Tools Linux
87. Hacking Tools Online
88. Pentest Tools Find Subdomains
89. Hacking Tools Windows
90. Pentest Tools Port Scanner
91. New Hacker Tools
92. How To Make Hacking Tools
93. Hacker Tools Linux
94. New Hack Tools
95. Hacking Tools For Windows
96. Pentest Tools Github
97. Hacking Tools Pc
98. Beginner Hacker Tools
99. Nsa Hacker Tools
100. Physical Pentest Tools
101. Hacker Tools 2020
102. What Is Hacking Tools
103. Hack Website Online Tool
104. Hacking Tools For Kali Linux
105. Tools 4 Hack
106. Hacker Tools Linux
107. Free Pentest Tools For Windows
108. Pentest Tools Nmap
109. Hacker Tools Apk
110. Hacker Techniques Tools And Incident Handling
111. Hacking Tools Download
112. What Is Hacking Tools
113. Pentest Tools Online