HProxy: Client-side detection of SSL stripping attacks

Nick Nikiforakis; Yves Younan; Wouter Joosen

doi:10.1007/978-3-642-14215-4_12

HProxy: Client-side detection of SSL stripping attacks

Nick Nikiforakis
, Yves Younan
, Wouter Joosen

Computer Science

KU Leuven

Research output: Chapter in Book/Report/Conference proceeding › Conference contribution › peer-review

16 Scopus citations

Abstract

In today's world wide web hundreds of thousands of companies use SSL to protect their customers' transactions from potential eavesdroppers. Recently, a new attack against the common usage of SSL surfaced, SSL stripping. The attack is based on the fact that users almost never request secure pages explicitly but rather rely on the servers, to redirect them to the appropriate secure version of a particular website. An attacker, after becoming man-in-the-middle can suppress such messages and provide the user with "stripped" versions of the requested website forcing him to communicate over an insecure channel. In this paper, we analyze the ways that SSL stripping can be used by attackers and present a countermeasure against such attacks. We leverage the browser's history to create a security profile for each visited website. Each profile contains information about the exact use of SSL at each website and all future connections to that site are validated against it. We show that SSL stripping attacks can be prevented with acceptable overhead and without support from web servers or trusted third parties.

Original language	English
Title of host publication	Detection of Intrusions and Malware, and Vulnerability Assessment - 7th International Conference, DIMVA 2010, Proceedings
Pages	200-218
Number of pages	19
DOIs	https://doi.org/10.1007/978-3-642-14215-4_12
State	Published - 2010
Event	7th GI International Conference on Detection of Intrusions and Malware and Vulnerability Assessment, DIMVA 2010 - Bonn, Germany Duration: Jul 8 2010 → Jul 9 2010

Publication series

Name	Lecture Notes in Computer Science (including subseries Lecture Notes in Artificial Intelligence and Lecture Notes in Bioinformatics)
Volume	6201 LNCS
ISSN (Print)	0302-9743
ISSN (Electronic)	1611-3349

Conference

Conference	7th GI International Conference on Detection of Intrusions and Malware and Vulnerability Assessment, DIMVA 2010
Country/Territory	Germany
City	Bonn
Period	07/8/10 → 07/9/10

Keywords

Browser Security
MITM Detection
SSL Stripping

Access to Document

10.1007/978-3-642-14215-4_12

Cite this

Nikiforakis, N., Younan, Y., & Joosen, W. (2010). HProxy: Client-side detection of SSL stripping attacks. In Detection of Intrusions and Malware, and Vulnerability Assessment - 7th International Conference, DIMVA 2010, Proceedings (pp. 200-218). (Lecture Notes in Computer Science (including subseries Lecture Notes in Artificial Intelligence and Lecture Notes in Bioinformatics); Vol. 6201 LNCS). https://doi.org/10.1007/978-3-642-14215-4_12

Nikiforakis, Nick ; Younan, Yves ; Joosen, Wouter. / HProxy : Client-side detection of SSL stripping attacks. Detection of Intrusions and Malware, and Vulnerability Assessment - 7th International Conference, DIMVA 2010, Proceedings. 2010. pp. 200-218 (Lecture Notes in Computer Science (including subseries Lecture Notes in Artificial Intelligence and Lecture Notes in Bioinformatics)).

@inproceedings{5705bf389c25481aab875b0dee9a6406,

title = "HProxy: Client-side detection of SSL stripping attacks",

abstract = "In today's world wide web hundreds of thousands of companies use SSL to protect their customers' transactions from potential eavesdroppers. Recently, a new attack against the common usage of SSL surfaced, SSL stripping. The attack is based on the fact that users almost never request secure pages explicitly but rather rely on the servers, to redirect them to the appropriate secure version of a particular website. An attacker, after becoming man-in-the-middle can suppress such messages and provide the user with {"}stripped{"} versions of the requested website forcing him to communicate over an insecure channel. In this paper, we analyze the ways that SSL stripping can be used by attackers and present a countermeasure against such attacks. We leverage the browser's history to create a security profile for each visited website. Each profile contains information about the exact use of SSL at each website and all future connections to that site are validated against it. We show that SSL stripping attacks can be prevented with acceptable overhead and without support from web servers or trusted third parties.",

keywords = "Browser Security, MITM Detection, SSL Stripping",

author = "Nick Nikiforakis and Yves Younan and Wouter Joosen",

year = "2010",

doi = "10.1007/978-3-642-14215-4\_12",

language = "English",

isbn = "3642142141",

series = "Lecture Notes in Computer Science (including subseries Lecture Notes in Artificial Intelligence and Lecture Notes in Bioinformatics)",

pages = "200--218",

booktitle = "Detection of Intrusions and Malware, and Vulnerability Assessment - 7th International Conference, DIMVA 2010, Proceedings",

note = "7th GI International Conference on Detection of Intrusions and Malware and Vulnerability Assessment, DIMVA 2010 ; Conference date: 08-07-2010 Through 09-07-2010",

}

Nikiforakis, N, Younan, Y & Joosen, W 2010, HProxy: Client-side detection of SSL stripping attacks. in Detection of Intrusions and Malware, and Vulnerability Assessment - 7th International Conference, DIMVA 2010, Proceedings. Lecture Notes in Computer Science (including subseries Lecture Notes in Artificial Intelligence and Lecture Notes in Bioinformatics), vol. 6201 LNCS, pp. 200-218, 7th GI International Conference on Detection of Intrusions and Malware and Vulnerability Assessment, DIMVA 2010, Bonn, Germany, 07/8/10. https://doi.org/10.1007/978-3-642-14215-4_12

HProxy: Client-side detection of SSL stripping attacks. / Nikiforakis, Nick; Younan, Yves; Joosen, Wouter.
Detection of Intrusions and Malware, and Vulnerability Assessment - 7th International Conference, DIMVA 2010, Proceedings. 2010. p. 200-218 (Lecture Notes in Computer Science (including subseries Lecture Notes in Artificial Intelligence and Lecture Notes in Bioinformatics); Vol. 6201 LNCS).

Research output: Chapter in Book/Report/Conference proceeding › Conference contribution › peer-review

TY - GEN

T1 - HProxy

T2 - 7th GI International Conference on Detection of Intrusions and Malware and Vulnerability Assessment, DIMVA 2010

AU - Nikiforakis, Nick

AU - Younan, Yves

AU - Joosen, Wouter

PY - 2010

Y1 - 2010

N2 - In today's world wide web hundreds of thousands of companies use SSL to protect their customers' transactions from potential eavesdroppers. Recently, a new attack against the common usage of SSL surfaced, SSL stripping. The attack is based on the fact that users almost never request secure pages explicitly but rather rely on the servers, to redirect them to the appropriate secure version of a particular website. An attacker, after becoming man-in-the-middle can suppress such messages and provide the user with "stripped" versions of the requested website forcing him to communicate over an insecure channel. In this paper, we analyze the ways that SSL stripping can be used by attackers and present a countermeasure against such attacks. We leverage the browser's history to create a security profile for each visited website. Each profile contains information about the exact use of SSL at each website and all future connections to that site are validated against it. We show that SSL stripping attacks can be prevented with acceptable overhead and without support from web servers or trusted third parties.

AB - In today's world wide web hundreds of thousands of companies use SSL to protect their customers' transactions from potential eavesdroppers. Recently, a new attack against the common usage of SSL surfaced, SSL stripping. The attack is based on the fact that users almost never request secure pages explicitly but rather rely on the servers, to redirect them to the appropriate secure version of a particular website. An attacker, after becoming man-in-the-middle can suppress such messages and provide the user with "stripped" versions of the requested website forcing him to communicate over an insecure channel. In this paper, we analyze the ways that SSL stripping can be used by attackers and present a countermeasure against such attacks. We leverage the browser's history to create a security profile for each visited website. Each profile contains information about the exact use of SSL at each website and all future connections to that site are validated against it. We show that SSL stripping attacks can be prevented with acceptable overhead and without support from web servers or trusted third parties.

KW - Browser Security

KW - MITM Detection

KW - SSL Stripping

UR - https://www.scopus.com/pages/publications/77955046129

U2 - 10.1007/978-3-642-14215-4_12

DO - 10.1007/978-3-642-14215-4_12

M3 - Conference contribution

AN - SCOPUS:77955046129

SN - 3642142141

SN - 9783642142147

T3 - Lecture Notes in Computer Science (including subseries Lecture Notes in Artificial Intelligence and Lecture Notes in Bioinformatics)

SP - 200

EP - 218

BT - Detection of Intrusions and Malware, and Vulnerability Assessment - 7th International Conference, DIMVA 2010, Proceedings

Y2 - 8 July 2010 through 9 July 2010

ER -

Nikiforakis N, Younan Y, Joosen W. HProxy: Client-side detection of SSL stripping attacks. In Detection of Intrusions and Malware, and Vulnerability Assessment - 7th International Conference, DIMVA 2010, Proceedings. 2010. p. 200-218. (Lecture Notes in Computer Science (including subseries Lecture Notes in Artificial Intelligence and Lecture Notes in Bioinformatics)). doi: 10.1007/978-3-642-14215-4_12

HProxy: Client-side detection of SSL stripping attacks

Abstract

Publication series

Conference

Keywords

Access to Document

Other files and links

Fingerprint

Cite this