ALPACA: Application Layer Protocol Confusion-Analyzing And Mitigating Cracks In TLS Authentication

In cooperation with the university Paderborn and Münster University of Applied Sciences, we discovered a new flaw in the specification of TLS. The vulnerability is called ALPACA and exploits a weakness in the authentication of TLS for cross-protocol attacks. The attack allows an attacker to steal cookies or perform cross-site-scripting (XSS) if the specific conditions for the attack are met.

TLS is an internet standard to secure the communication between servers and clients on the internet, for example that of web servers, FTP servers, and Email servers. This is possible because TLS was designed to be application layer independent, which allows its use in many diverse communication protocols.

ALPACA is an application layer protocol content confusion attack, exploiting TLS servers implementing different protocols but using compatible certificates, such as multi-domain or wildcard certificates. Attackers can redirect traffic from one subdomain to another, resulting in a valid TLS session. This breaks the authentication of TLS and cross-protocol attacks may be possible where the behavior of one protocol service may compromise the other at the application layer.

We investigate cross-protocol attacks on TLS in general and conducted a systematic case study on web servers, redirecting HTTPS requests from a victim's web browser to SMTP, IMAP, POP3, and FTP servers. We show that in realistic scenarios, the attacker can extract session cookies and other private user data or execute arbitrary JavaScript in the context of the vulnerable web server, therefore bypassing TLS and web application security.

We evaluated the real-world attack surface of web browsers and widely-deployed Email and FTP servers in lab experiments and with internet-wide scans. We find that 1.​4M web servers are generally vulnerable to cross-protocol attacks, i.e., TLS application data confusion is possible. Of these, 114k web servers can be attacked using an exploitable application server. As a countermeasure, we propose the use of the Application Layer Protocol Negotiation (ALPN) and Server Name Indication (SNI) extensions in TLS to prevent these and other cross-protocol attacks.

Although this vulnerability is very situational and can be challenging to exploit, there are some configurations that are exploitable even by a pure web attacker. Furthermore, we could only analyze a limited number of protocols, and other attack scenarios may exist. Thus, we advise that administrators review their deployments and that application developers (client and server) implement countermeasures proactively for all protocols.

More information on ALPACA can be found on the website https://alpaca-attack.com/.

Related articles

1. Hacking Tools
2. Pentest Tools Review
3. Best Pentesting Tools 2018
4. Hacking Tools Hardware
5. Hacker Tool Kit
6. Hacking Tools Kit
7. Hacker Tools
8. Pentest Tools Windows
9. Hacker Tool Kit
10. Pentest Automation Tools
11. Pentest Tools Download
12. Pentest Tools Website Vulnerability
13. Hacking Tools Online
14. Hacker Tools For Pc
15. Computer Hacker
16. Hacker Tool Kit
17. Hacker Tools Software
18. Hacking Tools Name
19. Hacking Tools Download
20. Hacking Tools For Windows 7
21. Hacking Tools Software
22. Hak5 Tools
23. Pentest Tools Windows
24. Hack Tools For Mac
25. Hack Tools For Ubuntu
26. Pentest Tools List
27. Pentest Automation Tools
28. Hacker Tools
29. Termux Hacking Tools 2019
30. Hack Tools Download
31. Pentest Tools For Ubuntu
32. Pentest Tools Apk
33. Hacking Tools For Pc
34. Pentest Tools Windows
35. Hacker
36. Pentest Recon Tools
37. Hacker Tools Software
38. Hacking Tools Software
39. Hacking Tools 2020
40. Hack Tools
41. Hack Website Online Tool
42. Hack Rom Tools
43. Best Pentesting Tools 2018
44. New Hack Tools
45. New Hacker Tools
46. What Is Hacking Tools
47. Hacker Tools Mac
48. Free Pentest Tools For Windows
49. Hack Tools For Mac
50. Pentest Tools For Windows
51. Hacking Tools
52. Pentest Automation Tools
53. Hacking Tools Online
54. Hackers Toolbox
55. Tools Used For Hacking
56. Pentest Tools For Windows
57. Hack Tools Mac
58. Hacking Tools
59. Hacking Tools Name
60. Underground Hacker Sites
61. Hacker Tools Software
62. Hack Tools For Mac
63. Hacking Tools For Windows
64. Hacking Tools For Mac
65. Hack Tools Pc
66. Hacker Hardware Tools
67. Pentest Tools Kali Linux
68. Hacker Tools For Pc
69. Hacker Security Tools
70. Bluetooth Hacking Tools Kali
71. Hack Tools Download
72. Hack And Tools
73. Pentest Tools Android
74. Hack Tools
75. Hacking Tools Online
76. Hacking Tools And Software
77. Kik Hack Tools
78. Install Pentest Tools Ubuntu
79. Pentest Automation Tools
80. Hacking Tools For Windows Free Download
81. Hacker