Man-in-the-middle attack in HTTP/2

Patni, Parth; Iyer, Kartik K.; Sarode, Rohan; Mali, Amit; Nimkar, Anant V.

doi:10.1109/i2c2.2017.8321787

Cited by 13 publications

(3 citation statements)

References 6 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…1. Ensure input matches its specification (CWE-20) usage, poses a risk of a man-in-the-middle attack (Patni et al 2017). To mitigate this, a system-level security requirement is necessary, which specifies the use of a secure application layer protocol (Rescorla & Schiffman 1999).…”

Section: Security Requirementsmentioning

confidence: 99%

Mitigating Injection-Based Weaknesses: A Flexible Template Architecture.

Ezenwoye

2024

JOT

View full text Add to dashboard Cite

Addressing vulnerabilities in software requires consideration of architectural issues. This paper presents a flexible architecture using design patterns to address software vulnerabilities. The architecture employs an extensible security template for mitigating injection-based weaknesses in authentication, authorization, and data validation. The paper presents the architecture's associated algorithms, demonstrates the mapping of weaknesses to use cases and the utilization of architectural, behavioral, and security patterns to mitigate them. A case study application is used to show the prevention of use-case specific weaknesses.

show abstract

Section: Security Requirementsmentioning

confidence: 99%

Mitigating Injection-Based Weaknesses: A Flexible Template Architecture.

Ezenwoye

2024

JOT

View full text Add to dashboard Cite

show abstract

“…It should be noted here that previous work on web attacks [15,16,17,18,19,20,21] has shown that server implementations are exposed to issues such as URL parsing, which may lead to server-side request forgery (SSRF) or path traversal attacks, and cache poisoning, which can enable an opponent to steal information or mount a remote code execution (RCE) attack. Additionally, works such as [22,23], illustrated different empirical attacks based on TLS vulnerabilities that could lead to MitM attacks. While the aforementioned assaults concern server-side attacks over the HTTP, they are irrelevant of the HTTP protocol version used and they are considered to be out-of-scope of this paper; thus, such attacks are omitted from the analysis that follows.…”

Section: Categories Of Attacks Against Http/2mentioning

confidence: 99%

A hands-on gaze on HTTP/3 security through the lens of HTTP/2 and a public dataset

Chatzoglou¹,

Kouliaridis²,

Kambourakis³

et al. 2022

Preprint

View full text Add to dashboard Cite

Following QUIC protocol ratification on May 2021, the third major version of the Hypertext Transfer Protocol, namely HTTP/3, was published around one year later in RFC 9114. In light of these consequential advancements, the current work aspires to provide a full-blown coverage of the following issues, which to our knowledge have received feeble or no attention in the literature so far. First, we provide a complete review of attacks against HTTP/2, and elaborate on if and in which way they can be migrated to HTTP/3. Second, through the creation of a testbed comprising the at present six most popular HTTP/3-enabled servers, we examine the effectiveness of a quartet of attacks, either stemming directly from the HTTP/2 relevant literature or being entirely new. This scrutiny led to the assignment of at least one CVE ID with a critical base score by MITRE. No less important, by capitalizing on a realistic, abundant in devices testbed, we compiled a voluminous, labeled corpus containing traces of ten diverse attacks against HTTP and QUIC services. An initial evaluation of the dataset mainly by means of machine learning techniques is included as well. Given that the 30 GB dataset is made available in both pcap and CSV formats, forthcoming research can easily take advantage of any subset of features, contingent upon the specific network topology and configuration.

show abstract

“…The study in [ 25 ] from 2019 presented a next-generation application DDoS called Multiplexed Asymmetric DDoS Attack, which causes the victim’s processor to overload by exploiting HTTP/2 multiplexing. HTTP/2 can also be exploited for a man-in-the-middle attack via DNS cache poisoning and a spoofed TLS (Transport Layer Security) certificate, as published in [ 26 ].…”

Section: Introductionmentioning

confidence: 99%

Generator of Slow Denial-of-Service Cyber Attacks

Sikora

Fujdiak

Kuchař

et al. 2021

Sensors

View full text Add to dashboard Cite

In today’s world, the volume of cyber attacks grows every year. These attacks can cause many people or companies high financial losses or loss of private data. One of the most common types of attack on the Internet is a DoS (denial-of-service) attack, which, despite its simplicity, can cause catastrophic consequences. A slow DoS attack attempts to make the Internet service unavailable to users. Due to the small data flows, these attacks are very similar to legitimate users with a slow Internet connection. Accurate detection of these attacks is one of the biggest challenges in cybersecurity. In this paper, we implemented our proposal of eleven major and most dangerous slow DoS attacks and introduced an advanced attack generator for testing vulnerabilities of protocols, servers, and services. The main motivation for this research was the absence of a similarly comprehensive generator for testing slow DoS vulnerabilities in network systems. We built an experimental environment for testing our generator, and then we performed a security analysis of the five most used web servers. Based on the discovered vulnerabilities, we also discuss preventive and detection techniques to mitigate the attacks. In future research, our generator can be used for testing slow DoS security vulnerabilities and increasing the level of cyber security of various network systems.

show abstract

Man-in-the-middle attack in HTTP/2

Cited by 13 publications

References 6 publications

Mitigating Injection-Based Weaknesses: A Flexible Template Architecture.

Mitigating Injection-Based Weaknesses: A Flexible Template Architecture.

A hands-on gaze on HTTP/3 security through the lens of HTTP/2 and a public dataset

Generator of Slow Denial-of-Service Cyber Attacks

Contact Info

Product

Resources

About