ALPACA: Application Layer Protocol Confusion-Analyzing And Mitigating Cracks In TLS Authentication

In cooperation with the university Paderborn and Münster University of Applied Sciences, we discovered a new flaw in the specification of TLS. The vulnerability is called ALPACA and exploits a weakness in the authentication of TLS for cross-protocol attacks. The attack allows an attacker to steal cookies or perform cross-site-scripting (XSS) if the specific conditions for the attack are met.

TLS is an internet standard to secure the communication between servers and clients on the internet, for example that of web servers, FTP servers, and Email servers. This is possible because TLS was designed to be application layer independent, which allows its use in many diverse communication protocols.

ALPACA is an application layer protocol content confusion attack, exploiting TLS servers implementing different protocols but using compatible certificates, such as multi-domain or wildcard certificates. Attackers can redirect traffic from one subdomain to another, resulting in a valid TLS session. This breaks the authentication of TLS and cross-protocol attacks may be possible where the behavior of one protocol service may compromise the other at the application layer.

We investigate cross-protocol attacks on TLS in general and conducted a systematic case study on web servers, redirecting HTTPS requests from a victim's web browser to SMTP, IMAP, POP3, and FTP servers. We show that in realistic scenarios, the attacker can extract session cookies and other private user data or execute arbitrary JavaScript in the context of the vulnerable web server, therefore bypassing TLS and web application security.

We evaluated the real-world attack surface of web browsers and widely-deployed Email and FTP servers in lab experiments and with internet-wide scans. We find that 1.​4M web servers are generally vulnerable to cross-protocol attacks, i.e., TLS application data confusion is possible. Of these, 114k web servers can be attacked using an exploitable application server. As a countermeasure, we propose the use of the Application Layer Protocol Negotiation (ALPN) and Server Name Indication (SNI) extensions in TLS to prevent these and other cross-protocol attacks.

Although this vulnerability is very situational and can be challenging to exploit, there are some configurations that are exploitable even by a pure web attacker. Furthermore, we could only analyze a limited number of protocols, and other attack scenarios may exist. Thus, we advise that administrators review their deployments and that application developers (client and server) implement countermeasures proactively for all protocols.

More information on ALPACA can be found on the website https://alpaca-attack.com/.

Related links

1. Best Pentesting Tools 2018
2. Pentest Tools For Mac
3. Computer Hacker
4. Pentest Reporting Tools
5. Beginner Hacker Tools
6. Hacker Tools Online
7. Best Hacking Tools 2019
8. Underground Hacker Sites
9. Growth Hacker Tools
10. Tools For Hacker
11. Pentest Automation Tools
12. Hacker Tools For Windows
13. Hacking Tools Windows 10
14. Nsa Hacker Tools
15. Hacking Tools For Mac
16. Hacker Security Tools
17. Hack Tools For Games
18. Hack Tools For Games
19. Hacking Tools Software
20. Pentest Tools Subdomain
21. Pentest Tools Android
22. How To Install Pentest Tools In Ubuntu
23. Hacker Tools 2019
24. How To Install Pentest Tools In Ubuntu
25. Hacking Tools
26. Hacking Tools And Software
27. Pentest Tools Review
28. Hacking Tools Download
29. Hacking Tools Hardware
30. Hacking Tools Online
31. Hack Tools Download
32. Hacking Tools Download
33. Hacker Tools 2019
34. Hack And Tools
35. Beginner Hacker Tools
36. Hacking Tools Software
37. Nsa Hack Tools
38. Pentest Tools Url Fuzzer
39. Pentest Tools Url Fuzzer
40. Hacking Tools And Software
41. Black Hat Hacker Tools
42. Hacking Tools Online
43. Hacking Tools For Windows 7
44. Pentest Tools Kali Linux
45. Hacking Tools For Beginners
46. Hacking Tools For Games
47. New Hack Tools
48. Computer Hacker
49. Best Hacking Tools 2020
50. Pentest Reporting Tools
51. Hacking Tools
52. Hack Tool Apk
53. Pentest Tools Subdomain
54. Pentest Tools Windows
55. Pentest Tools Website
56. Hack Tools Online
57. Top Pentest Tools
58. Hack Rom Tools
59. Hacking Tools Kit
60. How To Make Hacking Tools
61. Hacks And Tools
62. Hack Tools
63. Hacking Tools For Windows 7
64. Hacking Tools 2019
65. Tools For Hacker
66. Hack Tools Mac
67. Hacker Tools For Mac
68. Hacker Security Tools
69. Nsa Hack Tools
70. Android Hack Tools Github
71. Hack Tools Mac
72. Hacker Tools Free Download
73. Hacker
74. Hack Tools
75. Best Hacking Tools 2019
76. Hacking Tools Github
77. Pentest Tools For Android
78. Pentest Tools Url Fuzzer
79. Nsa Hack Tools
80. Hack Tools For Games
81. Pentest Recon Tools
82. Hack Tools For Ubuntu
83. Wifi Hacker Tools For Windows
84. Hacker Tools Hardware
85. Game Hacking
86. Bluetooth Hacking Tools Kali
87. Hacking Tools For Windows 7
88. Hacking Tools Github
89. Hackers Toolbox
90. Hacker Tools Apk Download
91. Hack Tool Apk No Root
92. Hack Website Online Tool
93. Hacker Tools Windows
94. Hacking Tools For Pc
95. Hacking Tools Kit
96. Hack Tool Apk
97. Hacker Tools For Ios
98. Pentest Tools Open Source
99. Hacking Tools