1. More Trick For Defeating SSL
DEFCON 17
Moxie Marlinspike

2. Outline 1. Introduction 2. Background Knowledge 3. sslstrip
SSL/TLS protocol
3. sslstrip
4. sslsniff
A. Basic Constraints vulnerability
B. Null-Prefix Attack
C. bypassing OCSP
5. Conclusion

3. Introduction
Demonstrate some new tricks for defeating SSL/TLS in places where sslstrip does not reach.

4. Background Knowledge SSL/TLS Protocol

5. SSL/TLS Introduction
abbreviation for Transport Layer Security and it’s successor Secure Socket Layer
Provide communication security over the Internet.
Even when the network is being MITM attack.

6. Network Stack

7. Handshake Process

8. Handshake Process

9. SSLstrip

10. SSLstrip Introduction[1]
demonstration of the HTTPS stripping attacks
It will transparently hijack HTTP traffic on a network, watch for HTTPS links and redirects, then map those links into either look-alike HTTP links or homograph-similar HTTPS links

11. How it work Bridge 302 redirect Hyper link
bridge
302 redirect
Hyper link

12. 302 Redirect

13. Detail – Normal Scenario
Server
User
User type:
example.com
Browser
Server reply
302 redirect to
SSL/TLS handshake
Serve reply
200 ok

14. Detail – Normal Scenario

15. Detail – Attack Scenario
Strip https to http
Record url
Server reply
302 redirect to
Server reply
302 redirect to
SSL/TLS handshake
Application Data
url match
Strip https to http
Stripped
Application Data
User/browser
Attacker
Server

16. Result(without strip)

17. Result(with strip)

18. What can’t sslstirp do
the browser query directly.
Bookmark
User typing
Other protocol
smtps
Ftps
Sftp….

19. SSLsniff - Basic Constraints vulnerability

20. Certificate Chaining

21. Certificate Chaining

22. How we verify
Verify that the name of the leaf node is the same as the site you're connecting to.
Verify that the leaf certificate has not expired.
Check the signature
If the signing CA is in our list of trusted root CAs, stop. Otherwise, move one up the chain and repeat.

25. What they say
Verify that the name of the leaf node is the same as the site you're connecting to.
Verify that the leaf certificate has not expired.
Check the signature
If the signing CA is in our list of trusted root CAs, stop. Otherwise, move one up the chain and repeat.

26. Something must be wrong, but...
All the signatures are valid.
Nothing has expired.
The chain is in tact.
The root CA is embedded in the browser and trusted.
But we just created a valid certificate for PayPal,
and we're not PayPal?

27. The missing piece

28. Back in the day Most CAs didn't explicitly set
basicConstraints: CA=False
Whether the field was there or not, most SSL implementations didn't bother to check it.
Anyone with a valid leaf node certificate could create and sign a leaf node certificate for any other domain.
When presented with a complete chain, IE, Outlook, Konqueror, OpenSSL, and others considered it valid...

29. And then in
Microsoft claimed that it was impossible to exploit.
So The Author published the tool that exploits it.

30. SSLsniff detail User/browser Attacker https://abc.example.com
1. Generate a certificate
for the site it is connected to
2. Sign it with any random valid
leaf node certificate.
3. Pass that certificate chain to
the client.
SSL/TLS handshake
SSL/TLS handshake
Get the Data from server
Encrypt it with our
private key
Send to user
Application Data
Application Data
User/browser
Attacker

31. SSLsniff – Null Prefix Attack Author’s PPT

32. What's with certificates, anyways?
X509 Certificate
Version
Serial Number
Issuer
Validity
Subject
PublicKey
Signature Algorithm
Signature
Issue by some Issuer
Identify some subjects
Get the public key
Issuer Signature

34. The Big Three Secrecy - Encryption algorithm
Authenticity - Digital Signature
Integrity - Checksum

35. SSL Handshake Beginnings