Pretty-Bad-Proxy: An Overlooked Adversary in Browsers' HTTPS Deployments

– HTTPS is designed to provide secure web communications over insecure networks. The protocol itself has been rigorously designed and evaluated by assuming the network as an adversary. This paper is motivated by our curiosity about whether such an adversary has been carefully examined when HTTPS is integrated into the browser/web systems. We focus on a specific adversary named “Pretty-BadProxy” (PBP). PBP is a malicious proxy targeting browsers’ rendering modules above the HTTP/HTTPS layer. It attempts to break the end-to-end security guarantees of HTTPS without breaking any cryptographic scheme. We discovered a set of vulnerabilities exploitable by a PBP: in many realistic network environments where attackers can sniff the browser traffic, they can steal sensitive data from an HTTPS server, fake an HTTPS page and impersonate an authenticated user to access an HTTPS server. These vulnerabilities reflect the neglects in the design of modern browsers – they affect all major bro...

• Type: Conference
• Year: 2009
• Where: SP
• Authors: Shuo Chen, Ziqing Mao, Yi-Min Wang, Ming Zhang
• Keywords: HTTPS, HTTPS Server, Security Privacy, SP 2009, We Believe