Hello, guys, and welcome to the second video of this chapter.
SSL stripping, as the name implies,
is an Attack that uses the SSL strip tool or a related techniques to strip away the
protection provided by the SSL TLS Protocol and HTTPS.
It's a form of man in the middle Attack that takes advantage of
the TLS protocol and the way it begins connections.
To understand everything, we are going to
need to start with HTTPs and man in the middle Attack.
When the World Wide Web was first
conceived, it wasn't intended for commerce or other vital services, it was a way for
the government and the academia to share information.
And that didn't require much security.
When the Internet was commercialized,
security and privacy became key considerations, the creation of the Secure
Sockets Layer SSL protocol was the first attempt as an answer.
It made connections via secure channel, the port four four three and layered
encryption over connections at the application level.
This was known as HTTP over SSL, or as is better known today, HTTPs.
But SSL was float.
And was quickly found to be vulnerable,
SSL 3.0 was replaced with Transport Layer Security TLS 1.0 in 1999.
The key difference was that TLS began connections with a hello via and insecure
channel before being redirected to a secure one.
Both use port four four, three and encrypt
HTTP connections, but the genesis of those connections differed.
And that's where SSL stripping comes in.
So when you connect to a Website, your connection has to be routed through
multiple and dozens of other points on its way to reach the desired destination.
If you are not using Encryption.
HTTPS in particular, all the data you are transmitting over the
connection passes through each one of those points in Plaintext,
that means anyone that is eavesdropping at one of those points can effectively
intercept the read and even manipulate everything that is being communicated.
The answer to this has historically been to encrypt the connection.
So even if someone is eavesdropping the
data, is in the cipher text and unreadable to the attacker, so therefore
SSL stripping is a workaround for that Encryption.
So we discussed earlier how TLS begins
within nsecure hello, before it's redirected to a secure channel.
So if a man in the middle attacker can redirect the client to an HTTP version of
the Website, it can steal information and manipulate the connection.
There are several ways this can be done.
The easiest is probably to set up a
proofed Wi-fi network in a public setting and Attack the people who login into it.
You can also compromise a point somewhere in the middle of the connection.
Because that initial hello, I'm HTTP direction, the quest is encrypted.
Because that initial hello and HTTP
Directory request is unencrypted, a man in the middle.
Can alter it and send the user to an insecure version of that page.
Keep in mind, however, that when you install a SSL, you are essentially
creating a duplicate of your Website with HTTPS URLs.
Those original HTTP URL still exist, though, usually use three zero one or
three zero two redirects to ensure users can reach the HTTP Website, but if an
attacker can manipulate the redirect, they can still send the user to that page.
Now, the user is still on your site, interacting as they normally would, but
every bit of data retransmit is in Plaintext.
In SSL stripping Attack Attack character as a Breach.
It's making an HTTPS connection with a
Server and an HTTP connection with a client.
That makes the connection appear secure, almost as if you were using the VPN, but
the Attacker is still in the data in this case.
So there are two main tactics that can be used to avoid such attacks.
You can use only the latest TLS protocol
version and/or Website to the HSTS preload list,
data engineering task force and the creators of TLS have worked very
hard to shore up this problem as one point two and never more. TLS
one point three have been designed to be resistant to this kind of attacks.
They encrypt more of the handshake.
The portion where the connection is redirected already TLS 2.0 and 3.0 have
been fully deprecated and the major tech companies have announced plans to hold
fully deprecate TLS 1.0 at one point one by January twenty twenty.
This is for good reason, TLS 1.2 an even more so TLS one point three is superior.
The other thing you can do is hold your Website, as we mentioned earlier, to the
HTTP Strict Transport Security preload list
you should already be using HSTS, which is an HTTP header that forces the
client to make a secure connection to the Website.
If the client can return HTTPS version of
the site, it just doesn't connect at the HSTS needed to download it first.
So the very first time a client arrives at
your Website, there is a small Attack vector for an attacker to SSL strip.
The HSTS preload list closes this window.
Once your site is included, any client
will know to only make secure connections, even if they never visited the site.
So that's all for this video.
You can just go ahead now and click on the
next video call Detecting Christmas Tree Attack.