Pretty-bad-proxy: An overlooked adversary in browsers' HTTPS deployments

Proceedings - IEEE Symposium on Security and Privacy

Volumn , Issue , 2009, Pages 347-359

  Chen, Shuo ^a   Mao, Ziqing ^b   Wang, Yi Min ^a   Zhang, Ming ^a  

^a MICROSOFT RESEARCH   (United States)

^b PURDUE UNIVERSITY   (United States)

Author keywords

Browser security; HTTPS deployment; Pretty bad proxy

Indexed keywords

ATTACK SCENARIOS; BROWSER SECURITY; CRYPTOGRAPHIC SCHEMES; END-TO-END SECURITY; INSECURE NETWORKS; NETWORK ENVIRONMENTS; SENSITIVE DATAS; WEB COMMUNICATIONS;

AUTHENTICATION; INTERNET PROTOCOLS; NETWORK SECURITY;

HTTP;

EID: 70449625210     PISSN: 10816011     EISSN: None     Source Type: Conference Proceeding    
DOI: 10.1109/SP.2009.12     Document Type: Conference Paper

References (24)

1. Andrea Bittau, Mark Handley, Joshua Lackey, "The Final Nail in WEP's Coffin, " the 2006 IEEE Symposium on Security and Privacy, Oakland, CA.
2. Grant Bugher. "WPAD: Internet Explorer's Worst Feature, " http://perimetergrid.com/wp/2008/01/11/wpad-internet-explorersworst-feature/.
3. Shuo Chen, Jose Meseguer, Ralf Sasse, Helen J. Wang, Yi-Min Wang, "A Systematic Approach to Uncover Security Flaws in GUI Logic, " in IEEE Symposium on Security and Privacy, Oakland, California, May 2007.
4. Shuo Chen, David Ross, Yi-Min Wang, "An Analysis of Browser Domain-Isolation Bugs and A Light-Weight Transparent Defense Mechanism, " in ACM Conference on Computer and Communications Security, Alexandria, VA, Oct-Nov 2007.
5. Cookie Property. MSDN. http://msdn2.microsoft.com/enus/library/ms533693. aspx.
6. T. Dierks and E. Rescorla. RFC5246: The Transport Layer Security (TLS) Protocol. http://tools.ietf.org/html/rfc5246.
7. Collin Jackson and Adam Barth, "ForceHTTPS: Protecting High- Security Web Sites from Network Attacks, " in Proceedings of the 17th International World Wide Web Conference (WWW2008).
8. Chris Karlof, Umesh Shankar, J.D. Tygar, and David Wagner, "Dynamic Pharming Attacks and Locked Same-origin Policies for Web Browsers, " the Fourteenth ACM Conference on Computer and Communications Security (CCS 2007), November 2007.
9. Benjamin Livshits and Monica S. Lam. "Finding Security Vulnerabilities in Java Applications with Static Analysis, " in Proc. Usenix Security Symposium, Baltimore, Maryland, August 2005.
10. Network Load Balancing: Frequently Asked Questions for Windows 2000 and Windows Server 2003. http://technet2.microsoft.com/windowsserver/en/library/ 884c727d-6083-4265-ac1d-b5e66b68281a1033.mspx?mfr=true.
11. Andreas Pashalidis. "A Cautionary Note on Automatic Proxy Configuration, " Proceedings of the IASTED International Conference on Communication, Network, and Information Security (CNIS 2003).
12. Mike Perry. "Active Gmail "Sidejacking" - https is NOT ENOUGH, " http://www.securityfocus.com/archive/1/475658/30/0/threaded.
13. Jason Rafail, "Cross-site scripting vulnerabilities, " www.cert.org/archive/pdf/cross-site-scripting.pdf.
14. Stuart E. Schechter, Rachna Dhamija, Andy Ozment, and Ian Fischer, "The Emperor's New Security Indicators: An evaluation of website authentication and the effect of role playing on usability studies, " in 2007 IEEE Symposium on Security and Privacy, Oakland, CA. May 20-23, 2007.
15. Alexander Sotirov, Marc Stevens, Jacob Appelbaum, Arjen Lenstra, David Molnar, Dag Arne Osvik, Benne de Weger. "MD5 considered harmful today - Creating a rogue CA certificate, " http://www.win.tue.nl/hashclash/rogue- ca/#sec71.
16. Niels Teusink. "Hacking random clients using WPAD, " http://blog.teusink.net/2008/11/about-two-weeks-ago-i-registeredwpad.Html.
17. US-CERT. "Multiple DNS implementations vulnerable to cache poisoning, " http://www.kb.cert.org/vuls/id/800113.
18. WinPcap: The Windows Packet Capture Library. http://www.winpcap.org/.
19. Wei Xu, Sandeep Bhatkar and R. Sekar. "Taint-Enhanced Policy Enforcement: A Practical Approach to Defeat a Wide Range of Attacks, " in Proc. the 15th USENIX Security Symposium, Vancouver, BC, Canada, July 2006.
20. MSDN Online. Using Automatic Configuration, Automatic Proxy, and Automatic Detection. http://www.microsoft.com/technet/prodtechnol/ie/reskit/6/ part6/c26ie6rk.mspx?mfr=true.
21. MSDN Online. WinHTTP AutoProxy Support. http://msdn.microsoft.com/en-us/ library/aa384240.aspx.
22. Internet access configuration instructions for some conferences, hotels, hospitals and airports that require proxies. http://homepage.eircom.net/~acsi/ encs08.htm http://www.hw.ac.uk/uics/Help-FAQs/WiFi-FAQs.html http://homepage.eircom.net/~acsi/encs08.htm http://www.ucd.ie/mcri/resources/IP- logistics-students.pdf http://www.vistagate.com/Demo/Administration/Help.htm http://www.grh.org/patWireless.html.
23. Internet access configuration instructions for some university departments and libraries that require proxies. http://groups.haas.berkeley.edu/ hcs/howdoi/AirBearsXP.pdf http://www.lib.berkeley.edu/Help/proxy-setup-ie5-7- dialup.html http://meded.ucsd.edu/edcom/tech-support/remote-access/web-prox y/internet-explorer/http://physics.ucsd.edu/~sps/html/resources/articles/ sciamsetup.html http://www.lib.ucdavis.edu/ul/services/connect/proxy/step1/ iewindo wslong.php.
24. Anonymizer: free web proxy, CGI proxy list, free anonymizers and the list of web anonymizers list. http://www.freeproxy.ru/en/free-proxy/cgi-proxy.htm.