Research and Implementation of Three HTTPS Attacks

Abstract

W ith the rapid development of network applications , the issues of Network transmission security become very important. Therefore, SSL protocol is more and more widely used in a variety of network services . But the SSL protocol itself is not perfect, in practice, there are also problems. For the deficiencies of endpoint authentication in the SSL handshake process, the paper analyzes two kinds of defects existing in the SSL hand-shake process. Firstly, handshake process, in the first stage of the SSL connection, using plaintexts, existing the possibility of being monitored and tampered. Secondly, SSL deployment of the actual application. Because of considering the factors about the performance of the network connection, that usually uses the way of switch connection based on HTTP protocol. In response to these deficiencies, this thesis adopts the two ways of forged certificates and converting the data stream from HTTPS to HTTP to attack them. In addition, a new attack mode against the data stream of HTTPS is designed and implemented. Experiments show that the above three methods cause significant security risks to HTTPS communications. Therefore, taking a static ARP table, enhanced certificate mechanism and mutual authentication of three different measures are proposed to enhance network security in the paper. It is shown that three ways can relative effectively defense against attacks on HTTPS in the experiments.