X.509 forensics: Detecting and localising the SSL/TLS men-in-the-middle

Lecture Notes in Computer Science (including subseries Lecture Notes in Artificial Intelligence and Lecture Notes in Bioinformatics)

Volumn 7459 LNCS, Issue , 2012, Pages 217-234

  Holz, Ralph ^a   Riedmaier, Thomas ^a   Kammenhuber, Nils ^a   Carle, Georg ^a  

^a TECHNICAL UNIVERSITY OF MUNICH   (Germany)

Author keywords

detection; localisation; Man in the middle attack; SSL TLS; X.509

Indexed keywords

AUTONOMOUS SYSTEMS; CENTRAL POINT; DEGREE OF CONFIDENCE; LOCALISATION; LOOKUPS; MAN IN THE MIDDLE ATTACKS; MAN IN THE MIDDLES (MITM); OUT-OF-BAND; PLANETLAB; SSL/TLS; X.509;

ERROR DETECTION; INTERNET PROTOCOLS; SECURITY SYSTEMS;

SECURITY OF DATA;

EID: 84865579512     PISSN: 03029743     EISSN: 16113349     Source Type: Book Series    
DOI: 10.1007/978-3-642-33167-1_13     Document Type: Conference Paper

References (21)

1. Mozilla Security Blog: DigiNotar removal follow up (2011), https://blog.mozilla.com/security/2011/09/02/diginotar-removal-follow-up/ (last retrieved in April 2012)
2. Engert, K.: Man-In-The-Middle experience in Warsaw. Blog entry (June 2011), https://kuix.de/blog/comments.php?y=11&m=06&entry=entry110616- 171707 (last retrieved in April 2012)
3. Eckersley, P.: A Syrian man-in-the-middle attack against Facebook (May 2011), https://www.eff.org/deeplinks/2011/05/syrian-man-middle-against-facebook (last retrieved in April 2012)
4. Borhani, A.: Is This MITM Attack to Gmail's SSL? Forum post (August 2011), https://www.google.com/support/forum/p/gmail/thread?tid= 2da6158b094b225a&hl=en (last retrieved in April 2012)
5. Vratonjic, N., Freudiger, J., Bindschaedler, V., Hubaux, J.P.: The inconvenient truth about Web certificates. In: 10th Workshop on Economics of Information Security, WEIS 2011 (June 2011)
6. Holz, R., Braun, L., Kammenhuber, N., Carle, G.: The SSL landscape - a thorough analysis of the X.509 PKI using active and passive measurements. In: Proc. 11th Annual Internet Measurement Conference (IMC 2011), Berlin, Germany. ACM, Sheridan (2011)
7. Eckersley, P., Burns, J.: Burns: Is the SSLiverse a safe place? Talk at 27C3 (2010), https://www.eff.org/files/ccc2010.pdf (last retrieved in April 2012)
8. Sunshine, J., Egelman, S., Almuhimedi, H., Atri, N., Cranor, L.F.: Crying wolf: an empirical study of SSL warning effectiveness. In: Proc. 18th USENIX Security Symposium, pp. 399-416 (2009)
9. Soghoian, C., Stamm, S.: Certified Lies: Detecting and Defeating Government Interception Attacks against SSL (Short Paper). In: Danezis, G. (ed.) FC 2011. LNCS, vol. 7035, pp. 250-259. Springer, Heidelberg (2012)
10. Electronic Frontier Foundation: The Sovereign Keys project (2011), https://www.eff.org/sovereign-keys (last retrieved in April 2012)
11. Laurie, B., Langley, A.: Certificate transparency (2012), http://www.certificate-transparency.org/ (last retrieved in April 2012)
12. Wendlandt, D., Andersen, D.G., Perrig, A.: Perspectives: Improving SSH-style host authentication with multi-path probing. In: Proc. USENIX 2008 Ann. Techn. Conf. (ATC) (2008)
13. Thoughtcrime Labs/IDS: Convergence (2011), http://convergence.io (last retrieved in April 2012)
14. Advanced Network Technology Center, University of Oregon: Route views project (2012), http://www.routeviews.org/ (last retrieved in April 2012)
15. Riedmaier, T., Holz, R.: Crossbear repository, https://github.com/ crossbear/Crossbear (last retrieved in April 2012)
16. Filastò, A., Appelbaum, J.: OONI: Open observatory of network interference. In: Proc. 2nd USENIX Workshop on Free and Open Communications on the Internet (FOCI 2012) (August 2012)
17. Teixeira, R., Shaikh, A., Griffin, T., Rexford, J.: Dynamics of hot-potato routing in IP networks. In: Proc. Joint Int. Conf. on Measurement and Modeling of Computer Systems (SIGMETRICS), pp. 307-319. ACM, New York (2004)
18. Qiu, S., McDaniel, P., Monrose, F.: Toward valley-free inter-domain routing. In: Proc. IEEE Int. Conf. on Communications (ICC), pp. 2009-2016 (June 2007)
19. Hepner, C., Zmijewski, E.: Defending against BGP man-in-the-middle attacks. Talk at BlackHat (2009), https://www.renesys.com/tech/presentations/ pdf/blackhat-09.pdf (last retrieved in April 2012)
20. Spring, N., Mahajan, R., Wetherall, D.: Measuring ISP topologies with Rocketfuel. In: Proc. ACM SIGCOMM, pp. 133-145. ACM, Pittsburgh (2002)
21. Alexa Internet Inc.: Top 1,000,000 sites (updated daily) (2009-2011), http://s3.amazonaws.com/alexa-static/top-1m.csv.zip (last retrieved in April 2012)