Breaking Out HSTS (and HPKP) on Firefox,IE/Edge and (Possibly) Chrome.

@unapibageek - @ssantosv

Sheila Ayelen Berta

Sergio De Los Santos

Security Researcher
ElevenPaths(Telefonica Digital cyber security unit)

Head of Innovation and Lab
ElevenPaths(Telefonica Digital cyber security unit)

22 years old -N/A :p -@unapibageek - @ssantosv

HTTP://www.example.com/login

C
Username: John / Password: 1234

@unapibageek - @ssantosv

CHTTPS://www.example.com/login

Username: John / Password: 1234(@unapibageek - @ssantosv

@unapibageek - @ssantosv

COMMONATTACKSSSLSTRIP

HSTS
HTTP Strict Transport Security

ROGUE CERTIFICATESSOLUTIONS?

HPKPHTTP Public Key Pinning@unapibageek - @ssantosv

HSTS – First time requests@unapibageek - @ssantosv

HSTS – HTTP requests after HSTS header is setted

THERE IS NOT A FIRST HTTP (UNSECURE) REQUEST.
SSLSTRIP HAS NOTHING TO INTERCEPT, IT WON’T WORK.

@unapibageek - @ssantosv

HPKP – Certificate Pinningpin-sha256="WoiWRyIOVNa9ihaBciRSC7XHjliYS9VwUGOIud4PB18=";
pin-sha256="RRM1dGqnDFsCJXBTHky16vi1obOlCgFFn/yOhI/y+ho=";@unapibageek - @ssantosv

HPKP – Certificate Pinning@unapibageek - @ssantosv

Attacking HSTS (and HPKP)
browsers implementation@unapibageek - @ssantosv

@unapibageek - @ssantosv

The curious thing…

1024 ENTRIESAS MAXIMUM@unapibageek - @ssantosv

@unapibageek - @ssantosv

DEMO@unapibageek - @ssantosv

@unapibageek - @ssantosv

@unapibageek - @ssantosv

Attack improvement… defeating FF’s score system

JUNK HSTS ENTRIES INJECTIONSCORE = 0

DELOREAN +1 DAY
SCORE = 1C

JUNK HSTS ENTRIES INJECTION
DELOREAN +1 DAY
JUNK HSTS ENTRIES INJECTIONSCORE = 2…
DEMO

@unapibageek - @ssantosv

FF’s highlights – Cons :• Attack might be a little complex to achieve:
MITM + DELOREAN + HSTS Injection.
• We need time enough inside the target’s network.
(It may be some hours).
Internal Pentests, Hotels… are the best scenarios ;)DEMO@unapibageek - @ssantosv

FF’s highlights - Pros:• Attack effectiveness.

HSTS SLOTSREAL ENTRY – SCORE = 0

NEW ENTRY – SCORE = 0

JUNK ENTRY – SCORE = 2
JUNK ENTRY – SCORE = 2
JUNK ENTRY – SCORE = 2

DEMO@unapibageek - @ssantosv

@unapibageek - @ssantosv

@unapibageek - @ssantosv

@unapibageek - @ssantosv

The curious thing…

NO STORAGE
LIMITS@unapibageek - @ssantosv

@unapibageek - @ssantosv

DEMO@unapibageek - @ssantosv

Chrome highlights:• Attack is very easy to achieve and you can try it in different ways.
(WiFi Portal / MITM attack / etc).

• Chrome stops working properly in a few minutes.
• User is forced to clear browsing data in Chrome and therefore theTransportSecurity file starts over again = HSTS/HPKP broken ;)@unapibageek - @ssantosv

@unapibageek - @ssantosv

@unapibageek - @ssantosv

The curious thing…

@unapibageek - @ssantosv

WININET.DLL
HttpIsHostHstsEnabled

CheckHsts()

AddHstsEntry()
CheckHstsInternal()

UpdateHstsEntry()

GetHstsEnabled()
IsHostHstsA()

SetHstsEntry()

GetHstsEntry()@unapibageek - @ssantosv

Landing issues…
CheckHsts()?

GetHstsEnabled()
CheckHstsInternal()?

IsHostHstsA()SetHstsEntry()
AddHstsEntry()

SaveEntryToStore()

IsHostHstsInternal()
ConvertURLtoHTTPS()@unapibageek - @ssantosv

I remember if
you visited thewebsite over
https or http…
but not becauseof HSTS itself...

CACHE
DEMO

@unapibageek - @ssantosv

IE/Edge highlights:• Most of the websites will not be remembered as webs
protected with HSTS, due to problems in the storage process.
• Browser cache is the one that remembers if you haveentered the website over http or https… but not HSTS itself.
• Restarting the browser, the machine or (most effectively) clearing
the cache, leaves the user without a real HSTS protection.

@unapibageek - @ssantosv

Conclusions…

We can tell there is not a strong bet yet for
improving this implementations in browsers so…
No one is safe….
even with HSTS.

@unapibageek - @ssantosv

THANK YOU!
Sheila Ayelen Berta

Sergio De Los Santos

Security Researcher – ElevenPaths(Telefonica Digital cyber security unit)@UnaPibaGeek
sheila.berta@11paths.com

Head of Research – ElevenPaths(Telefonica Digital cyber security unit)@ssantosv
sergio.delossantos@11paths.com@unapibageek - @ssantosv