ALPACA: Application Layer Protocol Confusion-Analyzing And Mitigating Cracks In TLS Authentication

In cooperation with the university Paderborn and Münster University of Applied Sciences, we discovered a new flaw in the specification of TLS. The vulnerability is called ALPACA and exploits a weakness in the authentication of TLS for cross-protocol attacks. The attack allows an attacker to steal cookies or perform cross-site-scripting (XSS) if the specific conditions for the attack are met.

TLS is an internet standard to secure the communication between servers and clients on the internet, for example that of web servers, FTP servers, and Email servers. This is possible because TLS was designed to be application layer independent, which allows its use in many diverse communication protocols.

ALPACA is an application layer protocol content confusion attack, exploiting TLS servers implementing different protocols but using compatible certificates, such as multi-domain or wildcard certificates. Attackers can redirect traffic from one subdomain to another, resulting in a valid TLS session. This breaks the authentication of TLS and cross-protocol attacks may be possible where the behavior of one protocol service may compromise the other at the application layer.

We investigate cross-protocol attacks on TLS in general and conducted a systematic case study on web servers, redirecting HTTPS requests from a victim's web browser to SMTP, IMAP, POP3, and FTP servers. We show that in realistic scenarios, the attacker can extract session cookies and other private user data or execute arbitrary JavaScript in the context of the vulnerable web server, therefore bypassing TLS and web application security.

We evaluated the real-world attack surface of web browsers and widely-deployed Email and FTP servers in lab experiments and with internet-wide scans. We find that 1.​4M web servers are generally vulnerable to cross-protocol attacks, i.e., TLS application data confusion is possible. Of these, 114k web servers can be attacked using an exploitable application server. As a countermeasure, we propose the use of the Application Layer Protocol Negotiation (ALPN) and Server Name Indication (SNI) extensions in TLS to prevent these and other cross-protocol attacks.

Although this vulnerability is very situational and can be challenging to exploit, there are some configurations that are exploitable even by a pure web attacker. Furthermore, we could only analyze a limited number of protocols, and other attack scenarios may exist. Thus, we advise that administrators review their deployments and that application developers (client and server) implement countermeasures proactively for all protocols.

More information on ALPACA can be found on the website https://alpaca-attack.com/.

More information

1. What Is Hacking Tools
2. Github Hacking Tools
3. Hacker Tools Github
4. Tools Used For Hacking
5. Nsa Hacker Tools
6. Hacker Tools Linux
7. Pentest Recon Tools
8. Pentest Tools Url Fuzzer
9. Hack Tools For Ubuntu
10. Hacking Tools Mac
11. Pentest Tools Url Fuzzer
12. Pentest Tools Kali Linux
13. Computer Hacker
14. Hacker Tools For Pc
15. Hacker Tools Github
16. Pentest Recon Tools
17. Top Pentest Tools
18. Pentest Tools Apk
19. Hacker
20. Hacking Tools For Games
21. Hacking Tools For Mac
22. Hacking Tools Usb
23. Hack Tools Pc
24. Pentest Reporting Tools
25. Kik Hack Tools
26. Game Hacking
27. Hack Website Online Tool
28. Hacking Tools Usb
29. Hacker Tools For Ios
30. Black Hat Hacker Tools
31. Hacker Tools List
32. Hacker Tools For Ios
33. Pentest Tools Open Source
34. Hack Rom Tools
35. Easy Hack Tools
36. Hacker Tools Mac
37. Hacker Tools 2020
38. Pentest Tools Online
39. Pentest Box Tools Download
40. Hack And Tools
41. Pentest Tools Bluekeep
42. Hacker Tool Kit
43. Hack Rom Tools
44. Hacker Tools Mac
45. Easy Hack Tools
46. Pentest Tools Linux
47. Hacking Tools Kit
48. Hack Tools For Games
49. Hacker Tools Linux
50. Hack And Tools
51. How To Make Hacking Tools
52. Hack Apps
53. Beginner Hacker Tools
54. Hacker Tools Mac
55. Physical Pentest Tools
56. Hack Website Online Tool
57. Hack Tools Download
58. Hack Tools Github
59. Hacker Tools For Ios
60. Pentest Tools For Windows
61. Hacker Tools Mac
62. Android Hack Tools Github
63. Hacking Tools Software
64. Nsa Hack Tools Download
65. Easy Hack Tools
66. Hak5 Tools
67. Pentest Tools Port Scanner
68. Hacking Tools Usb
69. Growth Hacker Tools
70. Hak5 Tools
71. Tools 4 Hack
72. Tools For Hacker
73. Pentest Tools Apk
74. Hacker Security Tools
75. Hacker Tools Software
76. Pentest Tools Nmap
77. Hacking Tools Github
78. Growth Hacker Tools
79. Hacking Tools 2019
80. Hacker Tools Windows
81. Pentest Tools Free
82. Termux Hacking Tools 2019
83. Pentest Tools Linux
84. Hack Rom Tools
85. Pentest Tools For Mac
86. Hack Tools For Pc
87. Hacking Tools Software
88. Pentest Tools Apk
89. Hack Tools For Ubuntu
90. Hacking Tools
91. Hacking Tools Github
92. Hacking Tools Kit
93. Hacker Tools Free
94. Hack Tools
95. Hacking Tools For Kali Linux
96. Hacker Tools Apk Download
97. Pentest Tools For Windows
98. Best Hacking Tools 2019
99. Pentest Tools Nmap
100. Hack And Tools
101. Pentest Tools Tcp Port Scanner
102. Hack Tools Online
103. Android Hack Tools Github
104. Hacking App
105. Hacking Tools For Windows Free Download
106. Pentest Tools Tcp Port Scanner
107. Pentest Tools For Mac
108. Hacking Tools And Software
109. Hacking Tools Software
110. Pentest Tools Subdomain
111. Pentest Tools Free
112. Growth Hacker Tools
113. Hacker Tools Mac
114. Pentest Tools Bluekeep
115. Pentest Tools Free
116. Hacker Tools Github
117. Bluetooth Hacking Tools Kali
118. Hack Tools
119. Pentest Tools Subdomain