3. 33
We all know what TLS is all about…
HTTPS / TLS CLEAR TEXT
HTTPS://www.example.com/login
Username:John/Password:1234
HTTP://www.example.com/login
Username:John/Password:1234
17. 1717
It is not neccesary to have a MAX score value… some with lower values may be evicted… and, even more…
it is just enough to have all but one with a score higher than 0, to leave the table with one practicable slot
18. 1818
Junk HSTS entries injection
Attack Improvement… Defeating FF’s Score System
Junk HSTS entries injection
SCORE=0
+1 day
SCORE=1
+1 day
Junk HSTS entries injection
SCORE=2
…
19. 1919
Junk HSTS entries injection
Attack Improvement… Defeating FF’s Score System
Junk HSTS entries injection
SCORE=0
Delorean +1 day
SCORE=1
Delorean +1 day
Junk HSTS entries injection
SCORE=2
…
21. 2121
FF’s Highlights - Cons:
• Attack might be a little complex to achieve:
MITM + DELOREAN (not for Windows) + HSTS Injection
• We need time enough inside the target’s network.
(It may be some hours).
• Internal Pentests, Hotel… are the best scenarios ;)
22. 2222
FF’s Highlights - Pros:
H
S
T
S
S
L
O
T
S
REAL ENTRY - SCORE=0
JUNK ENTRY - SCORE=2
JUNK ENTRY - SCORE=2
JUNK ENTRY - SCORE=2
● With a higher score more chances to remove existent
domains
● Even if not removed, table is “shrinked”
NEW ENTRY - SCORE=0
29. 2929
Chrome highlights
• Attack is very easy to achieve and you can try it in
differents ways (WiFi Portal / MITM attack / etc).
• Chrome stops working properly in a few minutes.
• User is forced to clear browsing data in Chrome and
therefore the TransportSecurity file starts over again:
HSTS/HPKP broken ;)
37. 3737
IE/Edge highlights
• Most of websites will not be remembered as webs protected with HSTS,
due to problems in the storage process.
• Browser cache is the one that remembers if you have entered the
website over http or https… but not HSTS itself.
• Restarting the browser, the machine or most effectively) clearing the
cache, leaves the user without a real HSTS protection.
38. 3838
Additional Staff: Mobile
• How does this affect mobiles?
• If you use IOS (any verson) or Android 4.0...
Forget about HPKP…
●
● In Chrome…
● …and Firefox…
52. 5252
• Firefox uses its own system with score that allows to: a) evict domains with low
score b) practically reduce the database to 1 entry (constantly overwritten)
• Chrome allows as many headers as possible, literally and it makes it crash
• All attacks may be achieved via MiTM or visiting a website
• Both has “minor” problems when parsing headers
• IE/Edge does not even work with “not known” domains
• We have created tools to a) check your local database (pinpatrol) b) test your
database (cloudpinning) d) delete your database (erarser post-exploitation
Metasploit module)
CONCLUSIONS
53. 5353
We can tell there is not a strong bet yet for
improving this implementations in
browsers...
CONCLUSIONS
El medio que usamos para proporcionar seguridad a nuestra solución.
Descubrimiento fortuito. Pensemos al revés. Al creador de una moneda virtual que quiere garantizar un mecanismo para las transacciones seguras, pero fuera del control de gobiernos y bancos.
El medio que usamos para proporcionar seguridad a nuestra solución.
Descubrimiento fortuito. Pensemos al revés. Al creador de una moneda virtual que quiere garantizar un mecanismo para las transacciones seguras, pero fuera del control de gobiernos y bancos.
El medio que usamos para proporcionar seguridad a nuestra solución.
Descubrimiento fortuito. Pensemos al revés. Al creador de una moneda virtual que quiere garantizar un mecanismo para las transacciones seguras, pero fuera del control de gobiernos y bancos.
El medio que usamos para proporcionar seguridad a nuestra solución.
Descubrimiento fortuito. Pensemos al revés. Al creador de una moneda virtual que quiere garantizar un mecanismo para las transacciones seguras, pero fuera del control de gobiernos y bancos.