Colon Cleanser - A Full Detox Plan For Body, Mind, And Soul

7/30/2019 Colon Cleanser - A Full Detox Plan For Body, Mind, And Soul

http://slidepdf.com/reader/full/colon-cleanser-a-full-detox-plan-for-body-mind-and-soul 1/99

New Tricks For Defeating SSL InPractice

Moxie Marlinspikemoxie@thoughtcrime.org

The Back Story

SSL And Certificate Chaining

You probably know what they do...

More specifically...

CA Certificate

SiteCertificate

Embedded in browser.

All powerful.Certifies that a site certificate isauthentic.

Identifies a particular URLIs known to be authentic basedon CA Certificate's signature.

CA Certificate

SiteCertificate

Embedded in browser.

All powerful.Certifies that an intermediateCA is authentic.

Identifies a particular URLIs known to be authentic basedon CA Certificate's signature.

IntermediateCANot embedded in browser.Still sort of all-powerful.Certifies that a site certificate isauthentic.

Here Be Dragons

Very tempting to use asimple recursivefunction.

Everyone focuses on thesignature validation.

The result of a naïveattempt at validation is

a chain that is complete,but nothing more.

...is a somewhat obscure field.

sslsniff

s s l s n i f f

sslsniff

s s l s n i f f

Back before people started checking BasicConstraints:

All you had to do was pass sslsniff a valid leaf node certificate for any domain.It would automatically generate a certificate for the domain the client was connecting toon the fly.It would sign that certificate with the leaf node.IE, Konqueror, etc... wouldn't notice the difference.

Th thi l i TV t di

The things you learn in TV studios.

The things you learn in TV studios

The things you learn in TV studios.

It's a button, so if you mouse-over it, the link isn't displayedin the browser bar at the bottom.The best you could do would be to view the page source,but that's problematic in browsers like Firefox that issue asecond request to the server for the source.

This button posts to an HTTPS link, but there's no way toknow that.

There are some generalizable attacks

Then: A Positive Feedback System

A number of indicators deployed to designate thata page is secure.

A proliferation of little lock icons.

URL bars that turn gold.

Now: An example from Firefox 3

Nobody types https://

(or http:// for that matter)

A First Cut Recipe: sslstrip

s s l s t r i p

Watch HTTP traffic go by.Switch <a href=”https://...”> to <a href=”http://...”> and keep a map of

what's changed.Switch Location: https://... to Location: http://... and keep a map of what'schanged.

How does it look?

Secure Site

A 1.5 Cut: sslstrip

s s l s t r i p

Let's do everything the same, but now watch out for favicon requests aswell.

If we see a favicon request for a URL that we've stripped, we'll send back afavicon of our choosing instead.

A new trick:

What should our favicon be?You guessed it:

You guessed it:

Once again, a secure site:

We're doing pretty good.

And if we want we can throw in a little lockicon.

ome s tes prov e no v s edifference.

The sites themselves confuse us.

A Few Gotchas

Content encodings that are difficult to parse(compress, gzip, etc...)

Secure cookies won't get sent over HTTP that'sbeen stripped of SSL.

Cached pages that don't give us a chance to swapout their links.

Another problem: sessions

The most interesting stuff to log are POSTs thatwould have been sent via SSL.

Particularly, usernames/passwords.

Sessions often cause us to miss the login step,

which is unfortunate.

Sure, we can get the session cookie, but that'ssmall change.

So let's strip sessions too.

s s l s t r i p

302 for the same URL,but with Set-Cookie:headers that expire allthe cookies we gotfrom the request.

Request

Request Again(Sans-Cookies)

And a little less sketchy...Sessions expire and it's not always clear when or why

When we start a MITM against a network, strip allthe traffic immediately, but don't touch the

cookies for 5 min (or some specified length of time).

As the cookies go by, make note of the activesessions.

After the time is up, start killing sessions, but onlynew sessions that we haven't seen before. Theseshould be the “long running” sessions that won'tbe seen as suspicious should they disappear.

Sessions expire, and it s not always clear when or why,but they don't usually expire right in the middle of anactive session. So what we do now:

Some Results Of This Trick?

login.yahoo.com 114Gmail 50

ticketmaster.com 42

rapidshare.com 14

Hotmail 13

paypal.com 9

linkedin.com 9

facebook.com 3

In 24 Hours

117 email accounts.16 credit card numbers.

7 paypal logins.

Over 300 other miscellaneous secure logins.

Number of people that balked.

Where can we go from here?

Combining this technique with homographattacks.

Sometimes the glphys of different characters lookalike. PayPaI.com looks like paypal.com but isreally paypai.com

Made more interesting by IDN. It became possibleto register a domain with characters that appearidentical to the glyphs of characters in the Latincharacter set.

In 2005, Eric Johanson registeredpаypal.com, which uses the Cryllic 'a' look-alike character and displays as paypal.com

Standard homograph attack:

Combining this technique with homographattacks.

The attack vector has to be targeted. Byregistering pаypal.com, all we can attackis paypal.com

Phishing is really just too much work. It'd be nicerif we could just MITM a network and get whateverpeople are doing.

The IDN stuff has been fixed. For TLDs like .com,Firefox renders the IDN characters as punycodeboth in the URL bar and the status bar.

What I don't like about the standard attack:

pаypal.com today

So how can we reinvent this to attackSSL?

We can't use .com or any TLD that Firefox willrender into punycode.

We want something that we can generalize, not just a simple substitution for some particular

character in a domain.So, what's in most URLs? . / & ?

one trick

Register a domain like ijjk.cnGet a domain-validated SSL wildcard cert for*.ijjk.cn

Use IDN-valid characters that look very similar to

'/' and '?' to create false URLs.MITM HTTP and swap out the HTTPS links as usual.

But this time, instead of just stripping the HTTPSlinks, we swap them out for our own look-alikes.

one trick

https://www.gmail.com/accounts/ServiceLogin becomeshttps://www.gmail.com/accounts/ServiceLogin?!f.ijj

The latter does not display as punycode in the

status bar or the URL bar.When resolved, it becomes www.google.xn--comaccountsservicelogin-5j9pia.f.ijjk.cn

When we MITM these connections, we do SSL on

both ends, but are able to present our own valid*.ijjk.cn cert to the client.

Here We Go

s s l s t r i p

302 for the same URL,but with Set-Cookie:headers that expire allthe cookies we gotfrom the request.

Request

Request Again(Sans-Cookies)

Proxy HTTP back, andswap out all the HTTPSlinks for our own look-alike HTTPS links.

SSL request for a look-alike domain that wecontrol.

Proxy data back fromthe actual domain.

An Example

Lessons...

Lots of times the security of HTTPS comes downto the security of HTTP, and HTTP is not secure.

If we want to avoid the dialogs of death, startwith HTTP not HTTPS.

Once we've got control of that, we can do allkinds of stuff to re-introduce the positiveindicators people might miss.

Other tricks...

sslstrip

http://www.thoughtcrime.org

Colon Cleanser - A Full Detox Plan For Body, Mind, And Soul

Documents

Quicker Start Guide: Colon Detox Protocol

7 DAY FAT FLUSH :- QUICK START GUIDE COLON DETOX PROTOCAL

irp-cdn.multiscreensite.com · Colon Cleanser 12 oz $9.99 reg. $13.79 Natural Factors WellBetX PGX 180 caps $24.69 reg. $32.99 ... organic Elderberries, fresh- Black Elderberry Syrup

PUTIPUTI RA ORGANICS - Squarespacestatic.squarespace.com/static... · Colon cleanser, digestive aid, can assist with bowel related disorders Better feed conversion, improves weight

7 DAY FAT FLUSH PLAN - COMPLETE PROCESS TO COLON DETOX PLAN

DETOX MYTHS BUSTED · understanding of physiology but the colon remains ground zero for detox advocates, who argue that a toxic sludge (sometimes called a mucoid plaque) is accumulating

Milk Cleanser

7 Day Fat Flush Plan: Colon Detox Protocol

The Bull Terrier...* Colon cleanser * Helps detox heavy metals, e-coli, bacteria, viruses, etc. * Completely safe and non-toxic * Stimulates basic metabolism * Antifungal properties

7 day fat flus plan -complete process to colon detox

Master Cleanser with Madal Bal SyrupMaster Cleanser with Madal Bal Syrup Author Elle Magazine Subject Hollywood's latest detox, we tried the improved version of the Master Cleanser

Cleanser+ Report

7 Day Fat Flush Plan -Complete Process to colon detox

Dr. Foster’s Essentials Parasite Cleansing System · Allow one hour after taking your supplements before taking Colon Soothe or Colon Detox Caps. Or Take Colon Soothe or Colon Detox

7 Day Fat Flus Plan - Complete Process To Colon Detox

COLON DETOX KIT - Amazon Web Services · Regular colon cleansing ensures you remove excess toxins and built up waste from your body. Without regular cleansing this waste is a feeding

7 Day fat flush plan, colon detox protocal ,quick start guide !

7 Day Fat Flush Plan complete Colon Detox Plan

complete body cleanse detox - Organic Herbal Colon … · reduced chance of detox symptoms we advise you to consider the following before you starting this body ... lemon juice. This

Stanley Burroughs - The Master Cleanser (Detox) Ocr