New TLS/SSL3. 0 middle attack has been published-vulnerability warning-the black bar safety net

ID MYHACK58:62200925213
Type myhack58
Reporter 佚名
Modified 2009-11-06T00:00:00


Just have the researchers published a method for the TLS/SSL man in the middle attack, the attack

1. exploitable (operable relatively strong)

2. Currently there is no solution, wait for the manufacturers of the patches.

3. The affected upper-layer protocols including HTTPS,IMAP, SIP, etc.

Someone gave this exampleto help everyone understand this hole

E. g., the attacker would send:

GET /pizza? toppings=pepperoni;address=attackersaddress HTTP/1.1 X-Ignore-This:

And leave the last line empty, without a carriage return line feed. Then when the client makes his own request

GET /pizza? toppings=sausage;address=victimssaddress HTTP/1.1 Cookie: victimscookie

the two requests get glued together int

GET /pizza? toppings=pepperoni;address=attackersaddress HTTP/1.1 X-Ignore-This: GET /pizza? toppings=sausage;address=victimssaddress HTTP/1.1 Cookie: victimscookie

And the server uses the victim's account to send a pizza to the attacker.

whitepaper text: <>

//Man in the middle attacks Man-in-the-Middle Attack, referred to as“MITM attack”is an“indirect”intrusion attack, this attack mode is achieved by various technical means will be subject to an intruder control of a virtual computer placed on the network connecting the two communication between computers, this computer is referred to as the“middle man”is. Then the intruders take this computer simulation of one or two of the original computer, so that the“middleman”to the original computer to establish the active connection and allow it to read or tamper with the transmitted information, however two of the original computer users were of the view that they are in communication with each other, and thus this attack is not easily to be found. So the man in the middle attacks very early to become a hacker used an ancient means of attack, and until today also has a greatly expanded space.