Upload File

mission accomplished? https security after diginotar · tls/https security extensions •...

  • Home
  • Documents
  • Mission Accomplished? HTTPS Security after DigiNotar · TLS/HTTPS Security Extensions • Certificate Transparency • HSTS (HTTP Strict Transport Security) • HPKP (HTTP Public
39
Mission Accomplished? HTTPS Security after DigiNotar Johanna Amann* Oliver Gasser* Quirin Scheitle* Lexi Brent Georg Carle Ralph Holz ICSI / LBL / Corelight Technical University of Munich Technical University of Munich The University of Sydney Technical University of Munich The University of Sydney * Joint First Authorship

Upload: others

Post on 27-Jun-2020

9 views

Category:

Documents


0 download

Report

TRANSCRIPT

Page 1: Mission Accomplished? HTTPS Security after DigiNotar · TLS/HTTPS Security Extensions • Certificate Transparency • HSTS (HTTP Strict Transport Security) • HPKP (HTTP Public

Mission Accomplished? HTTPS Security after DigiNotar

Johanna Amann*Oliver Gasser*Quirin Scheitle*Lexi BrentGeorg CarleRalph Holz

ICSI / LBL / CorelightTechnical University of MunichTechnical University of MunichThe University of SydneyTechnical University of MunichThe University of Sydney

* Joint First Authorship

Page 2: Mission Accomplished? HTTPS Security after DigiNotar · TLS/HTTPS Security Extensions • Certificate Transparency • HSTS (HTTP Strict Transport Security) • HPKP (HTTP Public

TLS/HTTPS Security Extensions

• Certificate Transparency

• HSTS (HTTP Strict Transport Security)

• HPKP (HTTP Public Key Pinning)

• SCSV (TLS Fallback Signaling Cipher Suite Value)

• CAA (Certificate Authority Authorization)

• DANE-TLSA (DNS Based Authentication of Named Entities)

Page 3: Mission Accomplished? HTTPS Security after DigiNotar · TLS/HTTPS Security Extensions • Certificate Transparency • HSTS (HTTP Strict Transport Security) • HPKP (HTTP Public

Methodology• Active & passive scans

• Shared pipeline where possible

• Active measurements from 2 continents

• Largest Domain-based TLS scan so far

• More than 192 Million domains

• Passive measurements on 3 continents

• More than 2.4 Billion observed TLS connections

Page 4: Mission Accomplished? HTTPS Security after DigiNotar · TLS/HTTPS Security Extensions • Certificate Transparency • HSTS (HTTP Strict Transport Security) • HPKP (HTTP Public

Certificate TransparencyCA

CT Log

Browser

Issues Certificates

Provides publicly auditable, append-only Log of certificates

Also provides proof of inclusion

Verifies proof of inclusion

Page 5: Mission Accomplished? HTTPS Security after DigiNotar · TLS/HTTPS Security Extensions • Certificate Transparency • HSTS (HTTP Strict Transport Security) • HPKP (HTTP Public

Certificate Transparency

CACT Log

BrowserWebserver

Page 6: Mission Accomplished? HTTPS Security after DigiNotar · TLS/HTTPS Security Extensions • Certificate Transparency • HSTS (HTTP Strict Transport Security) • HPKP (HTTP Public

Certificate Transparency

CACT Log

BrowserWebserver

Certificate

Page 7: Mission Accomplished? HTTPS Security after DigiNotar · TLS/HTTPS Security Extensions • Certificate Transparency • HSTS (HTTP Strict Transport Security) • HPKP (HTTP Public

Certificate Transparency

CACT Log

BrowserWebserver

Certificate

Cer

tifica

te

Page 8: Mission Accomplished? HTTPS Security after DigiNotar · TLS/HTTPS Security Extensions • Certificate Transparency • HSTS (HTTP Strict Transport Security) • HPKP (HTTP Public

Certificate Transparency

CACT Log

BrowserWebserver

Certificate

Cer

tifica

te

SCT

Page 9: Mission Accomplished? HTTPS Security after DigiNotar · TLS/HTTPS Security Extensions • Certificate Transparency • HSTS (HTTP Strict Transport Security) • HPKP (HTTP Public

Certificate Transparency

CACT Log

BrowserWebserver

Certificate

Certificate, SCT in TLS Ext.

Cer

tifica

te

SCT

Page 10: Mission Accomplished? HTTPS Security after DigiNotar · TLS/HTTPS Security Extensions • Certificate Transparency • HSTS (HTTP Strict Transport Security) • HPKP (HTTP Public

Certificate Transparency

CACT Log

BrowserWebserver

Page 11: Mission Accomplished? HTTPS Security after DigiNotar · TLS/HTTPS Security Extensions • Certificate Transparency • HSTS (HTTP Strict Transport Security) • HPKP (HTTP Public

Certificate Transparency

CACT Log

BrowserWebserver

Precertificate

Page 12: Mission Accomplished? HTTPS Security after DigiNotar · TLS/HTTPS Security Extensions • Certificate Transparency • HSTS (HTTP Strict Transport Security) • HPKP (HTTP Public

Certificate Transparency

CACT Log

BrowserWebserver

Precertificate

SCT

Page 13: Mission Accomplished? HTTPS Security after DigiNotar · TLS/HTTPS Security Extensions • Certificate Transparency • HSTS (HTTP Strict Transport Security) • HPKP (HTTP Public

Certificate Transparency

CACT Log

BrowserWebserver

Precertificate

SCT

Certificate (with

Precertificate SCT)

Page 14: Mission Accomplished? HTTPS Security after DigiNotar · TLS/HTTPS Security Extensions • Certificate Transparency • HSTS (HTTP Strict Transport Security) • HPKP (HTTP Public

Certificate Transparency

CACT Log

BrowserWebserver

Precertificate

SCT

Certificate (with

Precertificate SCT)

Certificate. Transform, Validate

Page 15: Mission Accomplished? HTTPS Security after DigiNotar · TLS/HTTPS Security Extensions • Certificate Transparency • HSTS (HTTP Strict Transport Security) • HPKP (HTTP Public

Certificate Transparency

CACT Log

BrowserWebserver

Page 16: Mission Accomplished? HTTPS Security after DigiNotar · TLS/HTTPS Security Extensions • Certificate Transparency • HSTS (HTTP Strict Transport Security) • HPKP (HTTP Public

Certificate Transparency

CACT Log

BrowserWebserver

Certificate

Page 17: Mission Accomplished? HTTPS Security after DigiNotar · TLS/HTTPS Security Extensions • Certificate Transparency • HSTS (HTTP Strict Transport Security) • HPKP (HTTP Public

Certificate Transparency

CACT Log

BrowserWebserver

Certificate

Certificate

Page 18: Mission Accomplished? HTTPS Security after DigiNotar · TLS/HTTPS Security Extensions • Certificate Transparency • HSTS (HTTP Strict Transport Security) • HPKP (HTTP Public

Certificate Transparency

CACT Log

BrowserWebserver

Certificate

Certificate

SCT

Page 19: Mission Accomplished? HTTPS Security after DigiNotar · TLS/HTTPS Security Extensions • Certificate Transparency • HSTS (HTTP Strict Transport Security) • HPKP (HTTP Public

Certificate Transparency

CACT Log

BrowserWebserver

Certificate

Certificate

SCT

OCSP, SCT in OCSP Reply

Page 20: Mission Accomplished? HTTPS Security after DigiNotar · TLS/HTTPS Security Extensions • Certificate Transparency • HSTS (HTTP Strict Transport Security) • HPKP (HTTP Public

Certificate Transparency

CACT Log

BrowserWebserver

Certificate

CertificateSCT in Stapled OCSP Reply

Certificate

SCT

OCSP, SCT in OCSP Reply

Page 21: Mission Accomplished? HTTPS Security after DigiNotar · TLS/HTTPS Security Extensions • Certificate Transparency • HSTS (HTTP Strict Transport Security) • HPKP (HTTP Public

SCT Statistics - ActiveSydney v4 Munich v4 Munich v6

Domains we could connect to 55.7M 58.0M 5.1M

Domains with SCT 6.8M 6.8M 357K

… via X509 6.7M 6.8M 344K

… via TLS Ext. 27.6K 27.2K 12.9K

… via OCSP 180 188 3

Certificates (Total) 10.62M 9.66M 549.98K

Certificates with SCT Ext. 799.9K 834.5K 193.9K

Page 22: Mission Accomplished? HTTPS Security after DigiNotar · TLS/HTTPS Security Extensions • Certificate Transparency • HSTS (HTTP Strict Transport Security) • HPKP (HTTP Public

SCT Statistics - PassiveCalifornia Munich Sydney

Time 4/4-5/2 5/12-5/16 5/12-5/16

Conns 2.6B 287M 196M

Conns with SCT 779M 73M 58M

… in Cert 520M 58M 44M

… in TLS 248M 14M 14M

… in OCSP 156K 38K 31K

# v4 IPs 737K 344K 226K

# SCT v4 IPs 222K 102K 66K

Page 23: Mission Accomplished? HTTPS Security after DigiNotar · TLS/HTTPS Security Extensions • Certificate Transparency • HSTS (HTTP Strict Transport Security) • HPKP (HTTP Public
Page 24: Mission Accomplished? HTTPS Security after DigiNotar · TLS/HTTPS Security Extensions • Certificate Transparency • HSTS (HTTP Strict Transport Security) • HPKP (HTTP Public
Page 25: Mission Accomplished? HTTPS Security after DigiNotar · TLS/HTTPS Security Extensions • Certificate Transparency • HSTS (HTTP Strict Transport Security) • HPKP (HTTP Public
Page 26: Mission Accomplished? HTTPS Security after DigiNotar · TLS/HTTPS Security Extensions • Certificate Transparency • HSTS (HTTP Strict Transport Security) • HPKP (HTTP Public
Page 27: Mission Accomplished? HTTPS Security after DigiNotar · TLS/HTTPS Security Extensions • Certificate Transparency • HSTS (HTTP Strict Transport Security) • HPKP (HTTP Public

105 Certificates, 91 Let’s Encrypt

Page 28: Mission Accomplished? HTTPS Security after DigiNotar · TLS/HTTPS Security Extensions • Certificate Transparency • HSTS (HTTP Strict Transport Security) • HPKP (HTTP Public
Page 29: Mission Accomplished? HTTPS Security after DigiNotar · TLS/HTTPS Security Extensions • Certificate Transparency • HSTS (HTTP Strict Transport Security) • HPKP (HTTP Public
Page 30: Mission Accomplished? HTTPS Security after DigiNotar · TLS/HTTPS Security Extensions • Certificate Transparency • HSTS (HTTP Strict Transport Security) • HPKP (HTTP Public

Log OperatorsActive Passive

Symantec log (81.26%) Symantec log (62.78%)

Google ’Pilot’ log (79.9%) Google ’Rocketeer’ log (58.6%)

Google ’Rocketeer’ log (31.72%) Google ’Pilot’ log (58.48%)

DigiCert Log Server (26.96%) Google ’Icarus’ log (14.37%)

Google ’Aviator’ log (25.67%) Google ’Aviator’ log (9.39%)

Google ’Skydiver’ log (8.32%) Vena log (7.47%)

Symantec VEGA log (3.98%) WoSign ctlog (4.64%)

StartCom CT log (1.49%) DigiCert Log Server (4.07%)

WoSign ctlog (0.67%) Google ’Skydiver’ log (1.7%)

Page 31: Mission Accomplished? HTTPS Security after DigiNotar · TLS/HTTPS Security Extensions • Certificate Transparency • HSTS (HTTP Strict Transport Security) • HPKP (HTTP Public

Log Operators

Page 32: Mission Accomplished? HTTPS Security after DigiNotar · TLS/HTTPS Security Extensions • Certificate Transparency • HSTS (HTTP Strict Transport Security) • HPKP (HTTP Public
Page 33: Mission Accomplished? HTTPS Security after DigiNotar · TLS/HTTPS Security Extensions • Certificate Transparency • HSTS (HTTP Strict Transport Security) • HPKP (HTTP Public
Page 34: Mission Accomplished? HTTPS Security after DigiNotar · TLS/HTTPS Security Extensions • Certificate Transparency • HSTS (HTTP Strict Transport Security) • HPKP (HTTP Public

HSTS, HPKP

• HSTS: ~3.5% of domains

• 0.2% send incorrect headers (misspellings, wrong attributes, …)

• HPKP: ~0.02% of domains (6,181)

• 41 invalid

Page 35: Mission Accomplished? HTTPS Security after DigiNotar · TLS/HTTPS Security Extensions • Certificate Transparency • HSTS (HTTP Strict Transport Security) • HPKP (HTTP Public

SCSV

Automatically deployed when servers/libraries update

> 96% deployment

Page 36: Mission Accomplished? HTTPS Security after DigiNotar · TLS/HTTPS Security Extensions • Certificate Transparency • HSTS (HTTP Strict Transport Security) • HPKP (HTTP Public

Deployment

Page 37: Mission Accomplished? HTTPS Security after DigiNotar · TLS/HTTPS Security Extensions • Certificate Transparency • HSTS (HTTP Strict Transport Security) • HPKP (HTTP Public
Page 38: Mission Accomplished? HTTPS Security after DigiNotar · TLS/HTTPS Security Extensions • Certificate Transparency • HSTS (HTTP Strict Transport Security) • HPKP (HTTP Public

Community Contributions• PCAPs of active scans

• Active scan results, CT database dumps

• Analysis Scripts (primarily Jupyter notebooks)

• Datasets: https://mediatum.ub.tum.de/1377982

• Software:

• goscanner (HTTPS scanner): https://github.com/tumi8/goscanner

• extended Bro TLS support (in master): https://bro.org

https://mediatum.ub.tum.de/1377982
https://github.com/tumi8/goscanner
https://bro.org
Page 39: Mission Accomplished? HTTPS Security after DigiNotar · TLS/HTTPS Security Extensions • Certificate Transparency • HSTS (HTTP Strict Transport Security) • HPKP (HTTP Public

Summary• Deployment status correlates with:

• Configuration effort

• Risk

• Default deployment / settings work best

• Measurements from several sites have very similar results

• One measurement location probably good enough in most cases


IOS Application Security Part 11 – Analyzing Network Traffic Over HTTP-HTTPS

http https Professor Marlon Sales

Konfigurasi web server https & http

Transferring Files Using HTTP or HTTPS...Transferring Files Using HTTP or HTTPS CiscoIOSRelease12.4providestheabilitytotransferfilesbetweenyourCiscoIOSsoftware-baseddevice

Http Vs Https

Limitless HTTP in an HTTPS World · Limitless HTTP in an HTTPS World Inferring the Semantics of the HTTPS Protocol without Decryption Blake Anderson, PhD y; Andrew Chi yz; Scott Dunlop

The technology behind the new Porsche 911 · https:/presskit.porsche.de https:/presse.porsche.de http:/newsroom.porsche.de http:/porsche-r.de/contacts Dr. Ing. h.c. F. Porsche AG

Security Engineering Lecture 13 – Web Application Security ... – OWASP Top 10 2013 Risks ... Transport layer HTTP/ HTTPS over TCP/IP APPLICATION SERVER WEB SERVER

HTTPs Strict Transport Security

Information Security CS 526...–HTTPS (HTTP over Secure Socket Layer) •User authentication & session management ... (ASP.NET) •ASP.NET 1.1: ... •More Web Security Issues –SQL

HTTPS--HTTP Server and Client with SSL 3 - Cisco · HTTPS--HTTP Server and Client with SSL 3.0 TheHTTPS--HTTPServerandClientwithSSL3.0featureprovidesSecureSocketLayer(SSL)version3.0

Security in IoT - brinel.ro · • Using HTTP/HTTPS to communicate between 2 software components written in any language, over any environment • Using HTTP GET/POST/PUT/DELETE to

Security with Passion - Industrial Networking Solutions · Endian UTM 3.0 - Whitepaper Security with Passion • HTTPS Filtering Now you can fully inspect and block web traffic (HTTP/HTTPS)

Presentacion HTTP/HTTPS/DNS

Website Security (HTTPS)

Konfigurasi Web Server HTTP dan HTTPS

KEAMANAN HTTP DAN HTTPS BERBASIS WEB MENGGUNAKAN SISTEM ...komputa.if.unikom.ac.id/jurnal/keamanan-http-dan-https.2b/...9033.pdf · tentang pentingnya keamanan sistem informasi

Web performance across the HTTP to HTTPS transition

Http, https, dns

Security Implications of Redirection Trail in Popular ...papers....HTTP Strict Transport Security (HSTS). Many websites support both HTTPS and HTTP for backward compatibility. Even

Вячеслав Бирюков - HTTP и HTTPS

HTTPS and HTTP/2

Transferring Files Using HTTP or HTTPS · Transferring Files Using HTTP or HTTPS CiscoIOSRelease12.4providestheabilitytotransferfilesbetweenyourCiscoIOSsoftware-baseddevice

Hypertext transfer family of protocols (HTTP, HTTPS, SOAP

Benefits of Https Over Http

HTTP-HTTPS API

Security Connections Newsletter May 2016 · Cognitive Threat Analytics (CTA) on Web Security Detect breaches with Cisco Web Security using anomaly detection of http and https traffic

Web server HTTP dan HTTPS

HTTP Vs HTTPS, All About SSL handshake

Security for Servers IS/CS 698 Min Song. What is web server NetscapeInternetExplorer Internet http (80) Web Server https(443)

The Security Impact of HTTPS Interception...root certificate on client Middlebox generates new certificate for client Plaintext HTTP Middlebox inspects inner HTTP content. How do we

Как переехать с http на https: пошаговая инструкция

Pertemuan #10 Secure HTTP (HTTPS) Kuliah Pengaman Jaringan

HTTP and HTTPS Statistics Services · Chapter 9 HTTP and HTTPS Statistics Services HTTP Statistics Service Next, submit a SOAP request written in an XML format to retrieve the information

Squid 3.5.4 Http & Https Cache Ubuntu 14.04