Researchers have disclosed a new type of attack that exploits
misconfigurations in transport layer security (TLS) servers to redirect
HTTPS traffic from a victim's web browser to a different TLS service
endpoint located on another IP address to steal sensitive information.
The attacks have been dubbed ALPACA,
short for "Application Layer Protocol Confusion - Analyzing and
mitigating Cracks in tls Authentication," by a group of academics from
Ruhr University Bochum, Münster University of Applied Sciences, and
Paderborn University.
"Attackers can redirect traffic from one subdomain to another,
resulting in a valid TLS session," the study said. "This breaks the
authentication of TLS and cross-protocol attacks may be possible where
the behavior of one protocol service may compromise the other at the
application layer."
TLS
is a cryptographic protocol underpinning several application layer
protocols like HTTPS, SMTP, IMAP, POP3, and FTP to secure communications
over a network with the goal of adding a layer of authentication and
preserving integrity of exchanged data while in transit.
ALPACA attacks are possible because TLS does not bind a TCP
connection to the intended application layer protocol, the researchers
elaborated. The failure of TLS to protect the integrity of the TCP
connection could therefore be abused to "redirect TLS traffic for the
intended TLS service endpoint and protocol to another, substitute TLS
service endpoint and protocol."
Given a client (i.e., web browser) and two application servers (i.e.,
the intended and substitute), the goal is to trick the substitute
server into accepting application data from the client, or vice versa.
Since the client uses a specific protocol to open a secure channel with
the intended server (say, HTTPS) while the substitute server employs a
different application layer protocol (say, FTP) and runs on a separate
TCP endpoint, the mix-up culminates in what's called a cross-protocol
attack.
Source: https://thehackernews.com/2021/06/new-tls-attack-lets-attackers-launch.html
