Slide 1
Slide 1 text
Circumventing SSL
Never trust your network
!
James Hall & Lawrence Dudley
Slide 2
Slide 2 text
Circumventing SSL
Never trust your network
!
James Hall & Lawrence Dudley
Slide 3
Slide 3 text
Contents
• How local networks work - introduction to ARP
• ARP spoofing
• Man in the middle - demo
• SSL in brief
• Certificate validation and user feedback
• SSL strip - demo
• Super evil injection - demo
Slide 4
Slide 4 text
How do local networks work?
Slide 5
Slide 5 text
How we thought they worked:
1. You plug it in
2. You get an IP address
3. Internet
Slide 6
Slide 6 text
There’s more to it than meets the eye
As web developers we forget that the things we do run on
hardware. We think of networks as TCP/IP or even just HTTP.
!
There’s actually 7 layers involved.
!
We’re going to discuss layers
2 and 3 - network and data link.
Slide 7
Slide 7 text
Layer 3 - Network
This is typically IPv4 and consists
of IP addresses.
!
!
!
!
Layer 2 - Data Link
This layer communicates using
MAC addresses.
Layers 2 and 3 - what do they do?
192.168.1.1 10:DD:B1:F3:38:66
Slide 8
Slide 8 text
This packet wants to go to 192.168.1.1
Example network request
Data
Packet
Destination:
192.168.1.1
Slide 9
Slide 9 text
The network translates this to a MAC address
Example network request
Data
Packet
Destination:
10:DD:B1:F3:38:66
Slide 10
Slide 10 text
IP/MAC Relationship
IP addresses are translated into a MAC address for transport on the
network. IP addresses are an abstraction.
!
How does a host know which IP belongs on which MAC?
Slide 11
Slide 11 text
Address resolution protocol
ARP is essentially a shared network phone book that maps IP and
MAC addresses together.
!
Each host tells the rest of the network which IP/MAC combinations it
has.
MAC Address IP Address
10:DD:B1:F3:38:66 192.168.1.1
00:B0:D0:86:BB:F6 192.168.1.1
00:B0:D0:86:BB:F8 192.168.1.2
00:B0:D0:86:BB:F7 192.168.1.3
Slide 12
Slide 12 text
The problem
ARP lacks any kind of authentication. If you tell a node that a certain IP
address belongs on a MAC address, it will believe you.
Slide 13
Slide 13 text
Normal operation
Data
Packet
Destination:
192.168.1.1
Data
Packet
Destination:
10:DD:B1:F3:38:66
MAC Address IP Address
10:DD:B1:F3:38:66 192.168.1.1
00:B0:D0:86:BB:F6 192.168.1.1
00:B0:D0:86:BB:F8 192.168.1.2
00:B0:D0:86:BB:F7 192.168.1.3
Slide 14
Slide 14 text
Device on network sends false info
Data
Packet
Destination:
192.168.1.1
Data
Packet
Destination:
10:DD:B1:F3:38:66
MAC Address IP Address
10:DD:B1:F3:38:66 192.168.1.1
00:B0:D0:86:BB:F6 192.168.1.1
00:B0:D0:86:BB:F8 192.168.1.2
00:B0:D0:86:BB:F7 192.168.1.3
Slide 15
Slide 15 text
MAC Address IP Address
10:DD:B1:F3:38:66 192.168.1.1
00:B0:D0:86:BB:F6 192.168.1.1
00:B0:D0:86:BB:F8 192.168.1.2
00:B0:D0:86:BB:F7 192.168.1.3
Device on network sends false info
!
!
!
!
Data
Packet
Destination:
192.168.1.1
Data
Packet
Destination:
00:A0:C9:14:C8:29
MAC Address IP Address
00:A0:C9:14:C8:29 192.168.1.1
00:B0:D0:86:BB:F6 192.168.1.1
00:B0:D0:86:BB:F8 192.168.1.2
00:B0:D0:86:BB:F7 192.168.1.3
Data
Packet
Destination:
10:DD:B1:F3:38:66
Because ARP doesn’t contain any authentication, it’s trivial to
convince a node to send data to the wrong place.
Slide 16
Slide 16 text
Typical local network
Most networks these days have clients, switches and routers. Most
networks have a combined switch/router.
Slide 17
Slide 17 text
Internet access
Access to the Internet is via the router. A client sends packets to the
router which sends them to the Internet.
Slide 18
Slide 18 text
Internet access
Access to the Internet is via the router. A client sends packets to the
router which sends them to the Internet.
Data
Packet
Slide 19
Slide 19 text
Internet access
Access to the Internet is via the router. A client sends packets to the
router which sends them to the Internet.
Data
Packet
Slide 20
Slide 20 text
Man in the middle
By spoofing the MAC address, it’s possible to direct the data
elsewhere, then send it on to the router.
Data
Packet
Slide 21
Slide 21 text
Man in the middle
By spoofing the MAC address, it’s possible to direct the data
elsewhere, then send it on to the router.
Data
Packet
Slide 22
Slide 22 text
Man in the middle
By spoofing the MAC address, it’s possible to direct the data
elsewhere, then send it on to the router.
Data
Packet
Slide 23
Slide 23 text
Live Demo
Slide 24
Slide 24 text
The Solution: SSL
SSL was invented to get around man in the middle attacks.
“OMG at hey!stack watching
@helloparallax. It’s awesome”
Slide 25
Slide 25 text
09FqtFo9rVxzrM8dMWyR6vBS3fWk72v5y
+bl7d4U0zcq7I/
M8ofdnG3+NdcWqO2fxHOXd5JcksmrmuXNFsem6+n
ovl8Kx9mvj8mwc/EdHoaRS2XFirSObXHvG
+0dURSOndrDifKnW6jonL6un6mKOZG3dvHtT83i2mZ
neZ3nvnpn5yjLuz7uTVvX7m7THKmOr
+6wY228bAomjEszcrnnXVw1+UdXdq2TxD0gaenRgxZ
Ms/rW2x1/
The Solution: SSL
SSL was invented to get around man in the middle attacks.
Slide 26
Slide 26 text
SSL Validation
SSL works on a trust basis. When a certificate isn’t trusted, you know
about it.
Slide 27
Slide 27 text
SSL Validation
What about positive messaging? It’s weak.
Slide 28
Slide 28 text
Question
Would people know about it if we sneakily did away with SSL?
Probably not…
Slide 29
Slide 29 text
SSL strip
Let’s imagine a normal SSL connection.
Slide 30
Slide 30 text
SSL Strip
Now let’s divert the connection via our evil network node.
Slide 31
Slide 31 text
SSL Strip
We take the HTTPS connection and turn it into an HTTP one, ignoring
any redirects to the secure version of a site. The average user is none
the wiser.
Slide 32
Slide 32 text
Live Demo