برچسب: Prevent

Hackers have used an SSL Strip for years. So why haven’t websites made it impossible to do? Learn how you can take your online security into your own hands.

Unfortunately, nearly every user of the Internet is susceptible all kinds of Wi-Fi hacking software.

And even though SSL Stripping was discovered nearly a decade ago, attackers can still exploit website vulnerabilities to steal your personal details online.

It’s up to you to make sure you’re secure. Here’s how you can protect yourself from these kinds of attacks!

What is a Man-In-The-Middle Attack?

Simply put, an SSL Strip is a type of “Man-in-the-middle” (MITM) attack.

During a man in the middle attack, hackers intercept data packages leaving the victim’s device as it travels to the intended destination. The Man-in-the-middle can then use your connection to:

• See all of the content you access.
• Modify any communication you have with any website.
• Access personal emails, passwords and other sensitive details.

This common attack is easily one of the easiest ways people have their personal identity and other sensitive details stolen over unsecured public Wi-Fi connections.

Alright, so this is the type of attack that is happening, so what does an SSL Strip have to do with it?

What is an SSL Strip?

An SSL Strip is a type of attack that lets a Man-in-the-middle read your private details in plain text. Essentially, a man in the middle takes a secure, HTTPS website, removes the ‘S’ (for secure), and downgrades the site to an HTTP connection.

What’s the difference between HTTP and HTTPS?

Well, the first difference you may notice is the ‘S’ – which is really what it all breaks down to. HTTPS stands for Hypertext Transfer Protocol Secure.

In theory, HTTPS connections provide:

• Authentication – If you see the green padlock icon and “https:” in your address bar, you can feel confident you are exchanging information with google.com and not a man in the middle.
• Confidentiality – Data transmitted using HTTPS will be encrypted, meaning no one else can read what information you are sending.  
• Integrity – The data you send over a TLS connection will not be tampered with or changed by a third party, meaning a man in the middle cannot redirect your packets of information.

It becomes obvious that HTTPS encryption is vitally important to ensure secure communication standards on the Internet.

How an SSL Strip Works

As mentioned, an SSL Strip, for lack of a better word, strips HTTPS down to HTTP, leaving your personal data exposed to hackers and third parties.

Once the man in the middle is the connection between your device and the Internet they can see your request to visit https://yourbank.com. They can then see the request, strip the SSL, and then forward it back to you. When you type in your credentials, the attacker pretends to be you without you ever having a clue.

In doing this, all of the traffic typed in on the user’s device is read in CLEAR text by the attacker. That means your email (clearly written), your password (served on a platter), and imagine if you log into your bank account or purchase something online!

Some scary facts:

• All an attacker needs is a simple $20 setup that you can purchase on the web.
• You’ll have no idea that an attacker has intercepted your connection.  

Why Haven’t I Heard of an SSL Strip Before?

Although the name sounds a bit strange, an SSL Strip is a very familiar term in the security world. It all started with Moxie Marlinspike – a well-known computer security researcher. In 2009, Marlinspike introduced the idea of an SSL Strip at a Black Hat conference in Washington D.C.

Although the finding did prompt new technology to protect users from these kinds of attacks, around 50% of websites still DON’T USE HTTPS.

But there may be hope for the future. Josh Aas, the co-founder of Let’s Encrypt, an organization that’s helping millions of sites add HTTPS to their sites for free, stated,  “Expectations for security will continue to rise, and as a result, we expect to see sites move to HTTPS even faster than they have been.” – Wired

How Websites Can Increase Security

After SSL Stripping was discovered, a higher level of security was found using HSTS (HTTP Strict Transport Security). Websites that implement HSTS will instruct your browser to only ever connect through HTTPS and require that your computer never connects while unencrypted using HTTP. That means, even if a man in the middle were to jump in and try to strip SSL attack your connection and transmit your data through HTTP, it wouldn’t be possible.

However, this method only works if you are not already being attacked during your first visit to the site. It is also quite hard for the average user to tell if a website implements HSTS or whether it has any vulnerabilities.

Therefore, users should consider further, more secure options for protecting their privacy.

How You Can Protect Yourself Against an SSL Strip

When an SSL strip can happen over many different types of networks, even those that are secured with passwords, it’s vitally important for users to protect themselves online. Here are a few things you can do to make sure your connection is never compromised by a man in the middle.

HTTPS Everywhere for Your Browser

One excellent way to make sure your browser is using HTTPS instead of just HTTP is by downloading The Electronic Frontier Foundation’s awesome tool called HTTPS Everywhere.

The tool is actually a browser extension that forces your browser to only send information over HTTPS websites. Unfortunately, you’ll quickly realize that if you set your preferences to reject sites that don’t use HTTPS, you may begin to find a rather lonely Internet (many sites still don’t use it!).

Use a VPN to Prevent an SSL Strip

A man in the middle attack is primarily possible when sharing a common network with the attacker. When using a VPN, all internet traffic is encrypted and protected within a secure VPN tunnel, meaning the attacker can’t even see that you’re on the same network.

With VPN security, you no longer need to worry about checking for HTTP, HTTPS, lock symbols or anything else! Type in usernames, passwords, or whatever you need and feel completely confident that no one else can see your online activities or private details.

Don’t be afraid of an SSL Strip. With SaferVPN you have absolutely nothing to worry about. We’ve got you covered.

If you don’t have SaferVPN yet, get a subscription today (we offer a 30-Day Money-Back Guarantee, you’ve got nothing to lose!) or try SaferVPN for free so you can enjoy peace of mind online.

Have any feedback, suggestions or feature requests? Feel free to contact us, ask questions in the comments, and join us on social media! We’d love to hear from you.