Abstract:HTTPS is principally designed for secure end-to-end communication, which adds confidentiality and integrity to sensitive data transmission. While several man-in-the-middle attacks (e.g., SSL Stripping) are available to break the secured connections, state-of-the-art security policies (e.g., HSTS) have significantly increased the cost of successful attacks. However, the TLS certificates shared by multiple domains make HTTPS hijacking attacks possible again. In this paper, we term the HTTPS MITM attacks based on the shared TLS certificates as HTTPS Context Confusion Attack (SCC Attack). Despite a known threat, it has not yet been studied thoroughly. We aim to fill this gap with an in-depth empirical assessment of SCC Attack. We find the attack can succeed even for servers that have deployed current best practice of security policies. By rerouting encrypted traffic to another flawed server that shares the TLS certificate, attackers can bypass the security practices, hijack the ongoing HTTPS connections, and subsequently launch additional attacks including phishing and payment hijacking. Particularly, vulnerable HTTP headers from a third-party server are exploitable for this attack, and it is possible to hijack an already-established secure connection. Through tests on popular websites, we find vulnerable subdomains under 126 apex domains in Alexa top 500 sites, including large vendors like Alibaba, JD, and Microsoft. Meanwhile, through a large-scale measurement, we find that TLS certificate sharing is prominent, which uncovers the high potential of such attacks, and we summarize the security dependencies among different parties. For responsible disclosure, we have reported the issues to affected vendors and received positive feedback. Our study sheds light on an influential attack surface of the HTTPS ecosystem and calls for proper mitigation against MITM attacks.

SSL-DP: A Rootkit of Network Based SSL and TLS Traffic Decryptor

Defense of Hidden Backdoor Technology for Web

Drpsd: An Novel Method Of Identifying Ssl/Tls Traffic

TPDD: A Two-Phase DDoS Detection System in Software-Defined Networking

Decrypting SSL/TLS traffic for hidden threats detection

Encryption Algorithm for TCP Session Hijacking

DDoSMiner: an Automated Framework for DDoS Attack Characterization and Vulnerability Mining.

Electrical Engineering and Computer Science SSL INT : A Tool for Detecting TLS Certificate Validation Vulnerabilities April 2016

Talking with Familiar Strangers: an Empirical Study on HTTPS Context Confusion Attacks

HSTS Measurement and an Enhanced Stripping Attack Against HTTPS.

A New Countermeasure for Protecting Authentication Protocols against Denial of Service Attack

Network Reconnaissance and Vulnerability Excavation of Secure DDS Systems

THE DEVELOPMENTS OF TLS1.3 AND ITS ATTACK AND DEFENSE

The Application of SSL Protocol in Computer Network Communication

Rusted Anchors - A National Client-Side View of Hidden Root CAs in the Web PKI Ecosystem.

Novel and Practical SDN-based Traceback Technique for Malicious Traffic over Anonymous Networks

THP: A Novel Authentication Scheme to Prevent Multiple Attacks in SDN-Based IoT Network.

Cactus: Obfuscating Bidirectional Encrypted TCP Traffic at Client Side

A survey and analysis of TLS interception mechanisms and motivations

Fingerprinting Sdn Applications Via Encrypted Control Traffic

A Survey on DNS Encryption: Current Development, Malware Misuse, and Inference Techniques