Can internet users protect themselves? Challenges and techniques of automated protection of HTTP communication

Völker, Lars; Noe, Marcel; Waldhorst, Oliver P.; Werle, Christoph; Sorge, Christoph

doi:10.1016/j.comcom.2010.06.016

Cited by 6 publications

(8 citation statements)

References 18 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…This makes a server able to present multiple certificates on a single IP address and to ultimately host multiple HTTPS sites using different certificates on the same IP address [2]. So, SNI is a useful complement to the concepts of virtual hosting, therefore a server is able to present the correct mapping between virtual hosts and the respective certificates [11].…”

Section: F Http Proxy Filteringmentioning

confidence: 98%

“…For the handshake, however, the web server has to supply the correct virtual site's certificate. A solution for this problem is the Server Name Indication (SNI) extension of TLS [11]. SNI allows a client to specify the hostname it is attempting to connect when the TLS negotiation starts, as shown in Figure 1.…”

Section: F Http Proxy Filteringmentioning

confidence: 99%

“…We added to this list the top 20 of the most globally visited HTTPS websites (Google, Facebook, Youtube, Twitter, etc.) according to Alexa 11 . We mainly tested the SNI backward compatibility weakness (see section IV-A) for bypassing SNI filtering but also the shared server certificate issue (section IV-B) in the specific case of Google's websites.…”

Section: B Evaluation Against Sni-based Firewallsmentioning

confidence: 99%

“…Most current server software, such as Apache or Microsoft IIS 8, already support the SNI extension [11]. On the browser …”

Section: B Deployment and Support Of Snimentioning

confidence: 99%

See 3 more Smart Citations

Efficiently bypassing SNI-based HTTPS filtering

Shbair

Cholez

Goichot

et al. 2015

2015 IFIP/IEEE International Symposium on Integrated Network Management (IM)

View full text Add to dashboard Cite

Encrypted Internet traffic is an essential element to enable security and privacy in the Internet. Surveys show that websites are more and more being served over HTTPS. They highlight an increase of 48% of sites using TLS over the past year, justifying the tendency that the Web is going to be encrypted. This motivates the development of new tools and methods to monitor and filter HTTPS traffic. This paper handles the latest technique for HTTPS traffic filtering that is based on the Server Name Indication (SNI) field of TLS and which has been recently implemented in many firewall solutions. Our main contribution is an evaluation of the reliability of this SNI extension for properly identifying and filtering HTTPS traffic. We show that SNI has two weaknesses, regarding (1) backward compatibility and (2) multiple services using a single certificate. We demonstrate thanks to a web browser plug-in called "Escape" that we designed and implemented, how these weaknesses can be practically used to bypass firewalls and monitoring systems relying on SNI. The results show positive evaluation (firewall's rules successfully bypassed) for all tested websites.

show abstract

Section: F Http Proxy Filteringmentioning

confidence: 98%

Section: F Http Proxy Filteringmentioning

confidence: 99%

Section: B Evaluation Against Sni-based Firewallsmentioning

confidence: 99%

“…Most current server software, such as Apache or Microsoft IIS 8, already support the SNI extension [11]. On the browser …”

Section: B Deployment and Support Of Snimentioning

confidence: 99%

See 2 more Smart Citations

Efficiently bypassing SNI-based HTTPS filtering

Shbair

Cholez

Goichot

et al. 2015

2015 IFIP/IEEE International Symposium on Integrated Network Management (IM)

View full text Add to dashboard Cite

show abstract

“…Consequently, exchanging information, finding people of similar opinions, and organizing meetings and social movements have become common (Moore and Zuev, 2005;Xiao et al, 2007;Xie and Wang, 2012;Baruah, 2012). However, along with the continuous growth in the popularity of group communication tools and services, their drawbacks also become more apparent (Sakarindr and Ansari, 2010;Völker et al, 2011).…”

Section: Introductionmentioning

confidence: 99%

A branch hash function as a method of message synchronization in anonymous P2P conversations

Kobusińska

Brzeziński

Boroń

et al. 2016

International Journal of Applied Mathematics and Computer Science

View full text Add to dashboard Cite

Currently existing solutions rarely protect message integrity, authenticity and user anonymity without burdening the user with details of key management. To address this problem, we present Aldeon-a protocol for anonymous group conversations in a peer-to-peer system. The efficiency of Aldeon is based on a novel tree synchronization algorithm, which is proposed and discussed in this paper. By using this algorithm, a significant reduction in the number of exchanged messages is achieved. In the paper, the formal definition of the proposed hash branch function and the proof of its efficiency are presented.

show abstract

Improving SNI-Based HTTPS Security Monitoring

Shbair

Cholez

Jérôme

et al. 2016

2016 IEEE 36th International Conference on Distributed Computing Systems Workshops (ICDCSW)

View full text Add to dashboard Cite

Recent surveys show that the proportion of encrypted web traffic is quickly increasing. On one side, it provides users with essential properties of security and privacy, but on the other side, it raises important challenges and issues for organizations, related to the security monitoring of encrypted traffic (filtering, anomaly detection, etc.). This paper proposes to improve a recent technique for HTTPS traffic monitoring that is based on the Server Name Indication (SNI) field of TLS and which has been implemented in many firewall solutions. This method currently has some weaknesses that can be used to bypass firewalls by overwriting the SNI value of new TLS connections. Our investigation shows that 92% of the HTTPS websites surveyed in this paper can be accessed with fake-SNI. Our approach verifies the coherence between the real destination server and the claimed value of SNI by relying on a trusted DNS service. Experimental results show the ability to overcome the shortage of SNI-based monitoring by detecting forged SNI values while having a very small false positive rate (1.7%). The overhead of our solution only adds negligible delays to access HTTPS websites. The proposed method opens the door to improve global HTTPS monitoring and firewall systems.

show abstract

Can internet users protect themselves? Challenges and techniques of automated protection of HTTP communication

Cited by 6 publications

References 18 publications

Efficiently bypassing SNI-based HTTPS filtering

Efficiently bypassing SNI-based HTTPS filtering

A branch hash function as a method of message synchronization in anonymous P2P conversations

Improving SNI-Based HTTPS Security Monitoring

Contact Info

Product

Resources

About