Let's go ahead and see what are the available attacks on a HTTPS.
There are two known attacks:
SSL Sniffing and SSL Striping!
Let's take them one by one.
ssl sniffing means performing a man-in-the-middle (MitM)
attack on SSL traffic.
The Hacker will run an ARP Spoofing attack to insert himself between the client which is the victim
and the orignal web server.
The hacker dynamically or on the fly generates certificates for the domains that are being accessed
and use those spoofed certificates for the part of the connection between him and the victim.
All traffic will be sniffed and seen in clear text. The victim's browser will recognize that the
certificate is not authentic because it's not signed by an authority
the browser trusts and will display a security warning.
This is such a security warning.
The certificate the server has sent to the client is not authentic.
Now if the user that accepts the security warning
Proceed to www.bbc.co.uk
he will be hacked; the encrypted data will be decrypted by the hacker using the spoofed certificate and
then sent to the destination web server encrypted using the original certificate.
The attack will be transparent so the hacker will use two certificates: the good one for the connection
between him and the web server and the spoofed certificate for the connection between him and the victim.
This attack cannot be performed on any website, especially on big ones like Google.com or Facebook
.com.
These websites use HSTS and if the victim uses the latest version of any browser the browser will not
accept a fake or a self signed certificate for those domains. In the next lecture
I'll show you live an ssl sniffing attack.
The 2nd known attack on HTTPS is called SSL stripping.
This is also known as HTTPS Downgrade attack because it will try to downgrade HTTPS connections
to their HTTP or unencrypted counterpart. Usually when you connect to a website
you don't specify a HTTP or HTTPS, you just write the domain name like google.com and the browser
connects to port 80 which is HTTP.
Usually the web server uses redirects to take users to the HTTPS site and to ensure that they
can’t reach the HTTP site. In an SSL stripping attack the hecker will manipulate the redirects and
send the users to the HTTP, unencrypted site.
Now the user is still on the site interacting as he normally would but every bit of data he transmits
is in plain text.
Note that SSL Stripping does not convert already established HTTPS connections to a HTTP.
It only does this in the sense that you urls are rewritten from HTTPS to HTTP. Note that this
is only a partial attack that does not work on any website.
There are so many variables involved. HSTS domains are especially immune to this attack!
In this lecture we've discussed about HTTP, HTTPS, HSTS and what are the available attacks.
In the next two lectures
I'll show you both an SSL Sniffing and an SSL Stripping attack.