Truncating TLS Connections to Violate Beliefs in Web Applications

Ben Smyth & Alfredo Pironti (2013) Truncating TLS Connections to Violate Beliefs in Web Applications. In WOOT'13: 7th USENIX Workshop on Offensive Technologies, USENIX Association. (First appeared at Black Hat USA 2013.)

Download

Abstract

We identify logical web application flaws which can be exploited by TLS truncation attacks to desynchronize the user- and server-perspective of an application's state. It follows immediately that servers may make false assumptions about users, hence, the flaw constitutes a security vulnerability. Moreover, in the context of authentication systems, we exploit the vulnerability to launch the following practical attacks: we exploit the Helios electronic voting system to cast votes on behalf of honest voters, take full control of Microsoft Live accounts, and gain temporary access to Google accounts.

Acknowledgement from Google and Microsoft

Our contribution has been acknowledged in Google's Hall of Fame and Microsoft's Security Researcher Acknowledgements.

Media coverage

This article has been discussed by The Register (local cache) and Spiegel Online (local cache).

Talk and video demonstrations

Our Black Hat talk and videos demonstrating our attacks against Google, Helios and Microsoft are available on YouTube:

Bibtex Entry

@inproceedings{2013-truncation-attacks-to-violate-beliefs,
	author = "Ben Smyth and Alfredo Pironti",
	title = "{Truncating TLS Connections to Violate Beliefs in Web Applications}",
	year = "2013",
	booktitle = "WOOT'13: 7th USENIX Workshop on Offensive Technologies",
	publisher = "USENIX Association",
	note = "(First appeared at Black Hat USA 2013.)",
}