Postcards from the Post-HTTP World: Amplification of HTTPS Vulnerabilities in the Web Ecosystem

Abstract

HTTPS aims at securing communication over the Web by providing a cryptographic protection layer that ensures the confidentiality and integrity of communication and enables client/server authentication. However, HTTPS is based on the SSL/TLS protocol suites that have been shown to be vulnerable to various attacks in the years. This has required fixes and mitigations both in the servers and in the browsers, producing a complicated mixture of protocol versions and implementations in the wild, which makes it unclear which attacks are still effective on the modern Web and what is their import on web application security. In this paper, we present the first systematic quantitative evaluation of web application insecurity due to cryptographic vulnerabilities. We specify attack conditions against TLS using attack trees and we crawl the Alexa Top 10k to assess the import of these issues on page integrity, authentication credentials and web tracking. Our results show that the security of a consistent number of websites is severely harmed by cryptographic weaknesses that, in many cases, are due to external or related-domain hosts. This empirically, yet systematically demonstrates how a relatively limited number of exploitable HTTPS vulnerabilities are amplified by the complexity of the web ecosystem.

Meddling Middlemen: Empirical Analysis of the Risks of Data-Saving Mobile Browsers

“…We demonstrate this vulnerability in both browsers in demo videos [11], [13]. This could potentially allow related-domain attackers [26] to bypass the cookie-integrity checks recently adopted by browsers that rely on cookie prefixes [24]. In both cases, the user sees a lock icon in the URL bar indicating their connection to the web server is secure, when in reality it is not.…”

Measuring Web Session Security at Scale

“…We audit the security of web sessions against the traditional threats posed by web attackers and network attackers, the standard attacker models of the web security literature [12], which have been commonly used in previous web session security studies, e.g., [13,14,8,15,1,16,17,9]. A web attacker is an unprivileged web user who operates a browser and has control of a malicious website.…”

“…We also assume perfect cryptography, in the sense that our analysis focuses on session security, not cryptographic security of HTTPS. Note that cryptographic weaknesses in HTTPS implementations are generally harder both to identify and to exploit in practice [16].…”

When TLS Meets Proxy on Mobile

“…Orthogonal to this line of research, researchers have studied the affects of TLS vulnerabilities on Web security [10]. Moreover, there have been studies on whether general Web security mechanisms (e.g., HSTS, CSP, Referrer Policy, etc.)…”