Abstract:HTTPS is principally designed for secure end-to-end communication, which adds confidentiality and integrity to sensitive data transmission. While several man-in-the-middle attacks (e.g., SSL Stripping) are available to break the secured connections, state-of-the-art security policies (e.g., HSTS) have significantly increased the cost of successful attacks. However, the TLS certificates shared by multiple domains make HTTPS hijacking attacks possible again. In this paper, we term the HTTPS MITM attacks based on the shared TLS certificates as HTTPS Context Confusion Attack (SCC Attack). Despite a known threat, it has not yet been studied thoroughly. We aim to fill this gap with an in-depth empirical assessment of SCC Attack. We find the attack can succeed even for servers that have deployed current best practice of security policies. By rerouting encrypted traffic to another flawed server that shares the TLS certificate, attackers can bypass the security practices, hijack the ongoing HTTPS connections, and subsequently launch additional attacks including phishing and payment hijacking. Particularly, vulnerable HTTP headers from a third-party server are exploitable for this attack, and it is possible to hijack an already-established secure connection. Through tests on popular websites, we find vulnerable subdomains under 126 apex domains in Alexa top 500 sites, including large vendors like Alibaba, JD, and Microsoft. Meanwhile, through a large-scale measurement, we find that TLS certificate sharing is prominent, which uncovers the high potential of such attacks, and we summarize the security dependencies among different parties. For responsible disclosure, we have reported the issues to affected vendors and received positive feedback. Our study sheds light on an influential attack surface of the HTTPS ecosystem and calls for proper mitigation against MITM attacks.

Identification of Bugs and Vulnerabilities in TLS Implementation for Windows Operating System Using State Machine Learning

Port Scanning Techniques and Analysis of Attack and Defense

State Machine Based Malicious Packet Attack Detection and Security Situation Assessment

Formatted Stateful Greybox Fuzzing of TLS Server

Vulnerability Analysis of Clock Synchronization Protocol Using Stochastic Petri Net

Model-Based Grey-Box Fuzzing of Network Protocols

Electrical Engineering and Computer Science SSL INT : A Tool for Detecting TLS Certificate Validation Vulnerabilities April 2016

Detecting Malignant TLS Servers Using Machine Learning Techniques

A new method for analyzing and improving security protocols

Finding Security Vulnerabilities in Network Protocol Implementations

A Combination of Timing Attack and Statistical Method to Reduce Computational Complexities of SSL/TLS Side-Channel Attacks.

Differential Fuzz Testing of TLS Implementations Based on Multi-Armed Bandit Variant

Deciphering Malware's use of TLS (without Decryption)

Talking with Familiar Strangers: an Empirical Study on HTTPS Context Confusion Attacks

Exploring Effective Fuzzing Strategies to Analyze Communication Protocols

A model-guided symbolic execution approach for network protocol implementations and vulnerability detection

An Analysis of Network Protocol Vulnerability Mining Using Fuzz Testing Combined with Deep Learning Models

Machine learning interpretability meets TLS fingerprinting

Specifying and Checking Network Protocol Based on TLA

Assessment of Hidden Channel Attacks: Targetting Modbus/TCP

DY Fuzzing: Formal Dolev-Yao Models Meet Cryptographic Protocol Fuzz Testing