All language subtitles for 7. SSL Stripping

Any attack that composition themselves in the middle between the source and destination traffic source

being here destination being here can perform man in the middle attacks one such attack that requires

pretty minimal skill and resources is called SSL stripping.

The attacker acts as a proxy here and changes encrypted Haiti CPS connections to hasty connections and

is a free tool available to do this called SSL strip which works with Hastey pay using SSL and that's

here and this is by a guy called Moxie marlinspike who's a fairly well renowned security researcher.

So was thinking about how we actually end up getting to hate Web sites.

Click here.

I was really a couple main ways that we end up getting into hate CPS Web sites and the first is this

way.

So we type in maybe the site that we're going for.

And we press return.

Now most often we do not type in Haiti ETP asked Colon slash slash.

What happens is we go to the Haiti ETP Web site and then the server gives is what's known as a three

to redirect and then sends us to this.

DP s version of the Web site another way that we get to hate CPS Web sites is if you go viral link so

a search here on Google.

And then there we have a link and we can see it is a hasty CBS link and then that takes us directly

to the hate U.P.S. version of Facebook.

So the way SSL strip works is it acts as a proxy working for those two types of events.

So three O2 redirects and links that are hated CPS proxies those connections.

So you send the original hate ETP connection it reaches the server the surface says actually no this

should be a hated to b s connection.

So it sends it back this prox is this pretending to be your browser and sends back a hasty ETP version

to you.

Server never knows any difference it thinks it's talking to you.

It believes this to be the browser and what you would see would be virtually identical to the actual

site.

So let me show you what the face for web site should look like.

So that's the legitimate Facebook Web site now Abdon Hey CGP stripping using Kalli and this is what

the stripped version looks like.

Jetman version stript version Jetman version stript version.

So as you can see the difference is you don't have the Haiti CPS and most people will not notice that

difference.

And as I said the server never sees anything is wrong because he's talking to a proxy that acts just

like you would act in order to perform this attack.

You need to be in the middle he need to be able to see the traffic so that you can strip it out and

it's not always that easy to be in the middle of someone else's traffic.

It really depends on where you are.

So if you're on someone else's network like for example you were you were in an internet cafe Internet

service provider.

All those people.

They control that network.

So they are in the middle.

So therefore they can perform this type of attack.

Obviously governments nation states they control network devices across the Internet.

So they are in the middle they can perform this sort of attack.

But this is not a very subtle attack as you can notice the meshing hate CPS.

But is not beyond the government in a targeted attack that they may consider doing this but it's reasonably

on lightly and it would very very unlikely be doing any sort of mass surveillance type way unless it

was some sort of tin pot government that was doing it because it's a pretty basic form of attack effective

for low resource low skilled attackers but not really nation state level attack a random cyber criminals

sat somewhere at a distance from you is going to really struggle to get in the middle of your traffic.

There are not really many mechanisms to do that.

And it therefore more likely that this distance attacker would attack your client instead because that's

just simply easier.

And people always go for what is easy as opposed to what is more difficult.

And if they attack your client and they're on your client they own your client.

They don't need to strip our SSL because they're real to see your data anyway because they're on your

client.

Another interesting way to do this attack is if the attackers sat on your local network so that's either

physically through the ethernet cables or wirelessly through Wi-Fi.

They can trick your machine into sending traffic through them.

And this is known as spoofing or poisoning the attacker sends out all packets pretending to be the victims

default gateway.

This works because Ethan It has no mechanism through authentication functionality.

So any machine can essentially send out what's known as this art packet and say that they are any other

machine that's on the network including the gateway or router which means you end up sending your traffic

through a fake router and then forwards on the traffic and strips out the SSL and then for the traffic

back to you like we've shown now if you want to learn more about ARP spoofing I would recommend this

Web site here which is quite good.

And here's a little diagram here where you can see the attacker here is saying look I'm the router and

the traffic is getting sent by them instead.

There are tools in Cali called ether cap an all spoof and obviously SSL strip which can enable you to

do this sort of attack.

And there's a tool called Cain and Abel which is here which you can use on Windows and this is the Web

site for SSL straight to and actually gives you the commands here for how to do this and everything

you need to do SSL stripping and the art of spoofing if your local is available within Kalai And actually

here it shows you the commands that you need to run.

And it's fairly simple.

You're enabling IP forwarding here making some changes to the IP table so it redirects the hate city

traffic to SSL strip running SSL strip here.

You need to put in the port here and then you are enabling the OP spoofing where you're telling the

target machine to send this traffic to you instead.

So if you'd like to have a play around with that and Kelly you can do that.

Another interesting way of stripping out your SSL is if you set up a rogue access point and then that

can be set to automatically strip down SSL.

So a rogue access point is when you connect to a Wi-Fi network and the owner of that one I find that

work is trying to attack us and Rogow fake access point and you can set that access point to strip out

SSL just as we spoke about because again they are obviously in the middle because that's what you're

connecting to and you can actually buy a piece of hardware that will do this for you.

And this is the Wi-Fi pineapple.

There's other versions.

But this is one that I would recommend you take this to a airport or somewhere a busy switch you don't

switch on an open network saying you know free Wi-Fi or something like that and you'll be amazed at

the number of passwords you'll get for Facebook and Google and all the rest of the Web sites by stripping

out the SSL.

People just do not notice.

It's probably worth pointing out actually that when you do strip SSL it means the connection is no longer

encrypted and therefore you can see all of the content and therefore you'll be able to steal usernames

and passwords and just see everything that the person is actually doing.

Now what can we do to help prevent this.

Well client side I mean you can attempt to notice that you don't have a hate CPS but you know if you're

busy that's not necessarily something that you might spot but you do need to keep your eye out for it.

A most solid method is to use a tunnel or encrypted tunnel so that it's not possible for them to strip

out the SSL because the traffic that you are sending is encrypted by a different mechanism.

So you can use S-sh for tunneling for example you can use VPN technology like IP PSEC But really what

you're after is end to end encryption and talk more on end to end encryption.

And also you don't want to connect really to untrusted networks without using tunneling or VPN or encryption

because this is exactly what can happen if you don't have a VPN or tunneling.

You SSL can be stripped out and all your traffic can be seen.

We're going to cover more on VPN as well on your local network is possible to detect to some degree

if ARP spoofing and sniffing is happening.

And there's a couple of examples of tools here that you can use.

This is all watch it monitors your ethernet to see whether ARP spoofing or poisoning is happening.

And there's another tool here which is a sniffer detection so it's seeing if anyone is watching the

network traffic.

Also service side bring a screen and you may not have control the service side but I guess in some instances

you might you can enable They can enable something called hate.

S ts all strict Transport Security which used a special response had to tell the browser to only accept

hasty traffic.

This only works if you visited the site before and then your client essentially remembers that they

only accept hate traffic and this is an example of where I've stripped out the SSL on an error message

because they've enabled Haiti to pay strict transport security all the way to prevent SSL stripping

and also ARP spoofing and poisoning is to use virtual lands and other forms of network isolation virtual

land prevents traffic going from one end of the network to another area of the network using a switch

and special tax.

If you're interested in that sort of thing then google around villans You can also have a general network

constellation.

If a attacker is not on the same physical network as you and the traffic is literally not going past

that attacker because we're on a different switch or going through a different router then obviously

they cannot get access to your traffic.

You can also use firewalls which prevent traffic going in certain directions and you can configure Wi-Fi

so that isolation using the configuration on your access point and you can set up separate Wi-Fi network.

So a guest network or network on a network.

And then those two networks cannot see the traffic or the other.

So there's lots of things you can do at the network.

And when we talk about your local network and Wi-Fi will go into more details on that.

So that's SSL stripping.