Simple and Lightweight HTTPS Enforcement to Protect against SSL Striping Attack

Abstract

SSL is a protocol for secured traffic connections. By using the SSL, HTTPS has been designed to prevent eavesdroppers and malicious users from web application services. However, man-in-the-middle attack techniques based on stripping and sniffing the HTTPS connections are still possible, causing security problems on web applications. Several scrip-kiddy tools to launch such attacks are easy to find and available on the Internet. In this paper, we therefore proposed a solution to protect against SSL striping attack. By enforcing a connection to HTTPS, our techniques determine the web URL and enforce the communication to HTTPS for protecting against the SSL striping attack. The experimental results on a test-bed have demonstrated an effectiveness and efficiency of our solution.

Implementation of DTCP-IP protected content on Android devices

“…This is important in order to achieve secure connection and data flow throughout network as well as content protection and copyright management. Several research presented in [12,13] report security attacks and breaches of streaming media content. These bring necessity for more security protocols and various ways of protecting content in the network.…”

Survey of the Protection Mechanisms to the SSL-based Session Hijacking Attacks

“…So, credential information are passed as plain text from the client to the attacker. HTTPS enforcer [26] uses a list of URLs that is kept at the client side. When a web page is requested and the communication between the web browser and web server is done over HTTP connection, the HTTP enforcer checks the list of URLs.…”

“…A test was performed using for ISAN-HTTPS Enforcer [26] on a web server containing Intel XEON 2.40 GHz processor with a RAM of 2GB. The Operating system in the server was CentOS 5.3, web server was Apache/2.…”

“…• Two-way authentication [22] • HTTPSLock [24] • Using ARP request packet to the gateway [23] • Monitoring ARP table [23] • Restricting ICMP packet [23] • SSLock [25] • HSTS [37] • ISAN-HTTPS Enforcer [26] • SHS-HTTPS Enforcer [27] • Cookie Proxy [38] 3 Categorization of Existing Approaches SSL stripping attack is targeted towards client. So client must defend against the attack.…”

“…There exists several recent works [7][8][9][10][11][12][13] on threats and security analysis of mobile applications and SSL/TLS deployment in mobile applications. Other HTTPS and TLS/SSLbased attack techniques are discussed in several works [14][15][16][17][18][19][20][21] There have been several existing solutions proposed specifically for SSL stripping attack, for example, ARP-related solutions [22,23], web script based solutions [24][25][26][27], MITM based solutions [28] and others [29][30][31][32][33]. However, there has been no survey that compiles all the solutions against SSL stripping-based session hijacking attacks which are crucial security threats for web users.…”