SSL Spoofing.pdf

(2364 KB) Pobierz

SSL Spoofing

Man-In-The-Middle attack on SSL

Duane Peifer

Summary



How SSL works



Common SSL misconceptions



SSL Spoofing



Using sslstrip



Preventing SSL Spoofing



Examples of stripped sites

How SSL works

Client hello

Client PC

Server hello

Certificate

Web Server

Server hello done

Client key exchange

Change cipher spec

Finished

Change cipher spec

Finished

Secure connection

How SSL works

HTTP

TCP

HTTP

HTTPS

TCP

SSL

HTTP

Common SSL misconceptions



HTTPS means I am secure right?



What about…

− SSL version 2.0 flaws

− Weak Ciphers < 128 bit

− Certificate keys < 1024 bits

− Client vulnerabilities

− Server vulnerabilities

− Application vulnerabilities



SSL can provide a false sense of

security

SSL Spoofing.pdf

Plik z chomika:

Inne pliki z tego folderu:

Inne foldery tego chomika: