Sciweavers

SP
2009
IEEE

Pretty-Bad-Proxy: An Overlooked Adversary in Browsers' HTTPS Deployments

14 years 7 months ago
Pretty-Bad-Proxy: An Overlooked Adversary in Browsers' HTTPS Deployments
– HTTPS is designed to provide secure web communications over insecure networks. The protocol itself has been rigorously designed and evaluated by assuming the network as an adversary. This paper is motivated by our curiosity about whether such an adversary has been carefully examined when HTTPS is integrated into the browser/web systems. We focus on a specific adversary named “Pretty-BadProxy” (PBP). PBP is a malicious proxy targeting browsers’ rendering modules above the HTTP/HTTPS layer. It attempts to break the end-to-end security guarantees of HTTPS without breaking any cryptographic scheme. We discovered a set of vulnerabilities exploitable by a PBP: in many realistic network environments where attackers can sniff the browser traffic, they can steal sensitive data from an HTTPS server, fake an HTTPS page and impersonate an authenticated user to access an HTTPS server. These vulnerabilities reflect the neglects in the design of modern browsers – they affect all major bro...
Shuo Chen, Ziqing Mao, Yi-Min Wang, Ming Zhang
Added 21 May 2010
Updated 21 May 2010
Type Conference
Year 2009
Where SP
Authors Shuo Chen, Ziqing Mao, Yi-Min Wang, Ming Zhang
Comments (0)