Subject: [HASMAT] HSTS Threat prevalence

From: Devdatta Akhawe <[email-masked]>
Date: Fri, 6 Aug 2010 11:36:12 -0700

Hi all

The HSTS specification talks about possible attacks that could be
prevented by the use of HSTS. Do we have any data that suggests these
attacks are actually a concern / being used by attackers anywhere ? I
couldn't find any citation to this effect in the specification.

thanks

regards
devdatta

---

From: Devdatta Akhawe <[email-masked]>
Date: Fri, 6 Aug 2010 12:09:21 -0700

#1 would be good - for a reasonably representative sample (i.e. no
stories ' I once sat in a cafe and ... ').

cheers
devdatta

On 6 August 2010 11:52, Steingruebl, Andy <[email-masked]> wrote:
>> -----Original Message-----
>> From: [email-masked] [mailto:[email-masked]] On
>> Behalf Of Devdatta Akhawe
>> Sent: Friday, August 06, 2010 11:36 AM
>> To: IETF HASMAT list
>> Subject: [HASMAT] HSTS Threat prevalence
>>
>> Hi all
>>
>> The HSTS specification talks about possible attacks that could be prevented
>> by the use of HSTS. Do we have any data that suggests these attacks are
>> actually a concern / being used by attackers anywhere ? I couldn't find any
>> citation to this effect in the specification.
>
> We are actively doing research in this area, but we don't know of any published work at this point.
>
> For the wider audience - do you want to know:
> 1. Whether this is occurring
> 2. Its overall frequency/distribution
> 3. Both
>
> Which of these would be most compelling?  On a percentage basis the number of connections being observed by passive network attackers is probably very small.  That doesn't by itself mean to should get rid of TLS.
>
> Me - I initially want the answer to #1, and then to #2.
>
> - Andy
>

---

From: Marsh Ray <[email-masked]>
Date: Fri, 06 Aug 2010 14:16:45 -0500

> stories ' I once sat in a cafe and ... ').

How about "I've sat in cafes on multiple occasions with professional 
pen-testers who told me that they employ these techniques quite 
effectively on a regular basis"?

- Marsh

> On 6 August 2010 11:52, Steingruebl, Andy<[email-masked]>  wrote:
> _______________________________________________
> HASMAT mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/hasmat

---

From: Devdatta Akhawe <[email-masked]>
Date: Fri, 6 Aug 2010 15:08:03 -0700

> pen-testers who told me that they employ these techniques quite effectively
> on a regular basis"?

I am not sure if people targeted by professional pentesters are a
"representative sample" of the general web user populace.

Maybe I have a very optimistic/naive view of things.

cheers
devdatta

>>>> prevented
>>> Which of these would be most compelling?  On a percentage basis the
>>> number of connections being observed by passive network attackers is
>>> probably very small.  That doesn't by itself mean to should get rid of TLS.
>>>

---

From: Devdatta Akhawe <[email-masked]>
Date: Fri, 6 Aug 2010 15:27:03 -0700

> One easy approach we considered was thinking of likely places for these types of attacks, and seeing if w can detect them.  One easy example is airports. Look for wifi in an airport and you'll usually see quite a number of "free wifi" SSIDs, all with slightly carrying names.  Who knows which one is the real one.  I'd like to do a little experimenting on how many of those are rogue.
>

I would add 'and are trying to do things which STS would have prevented'

-devdatta

On 6 August 2010 15:23, Steingruebl, Andy <[email-masked]> wrote:
>> From: Devdatta Akhawe [mailto:[email-masked]]
>> Sent: Friday, August 06, 2010 3:08 PM
>> To: Marsh Ray
>> Cc: Steingruebl, Andy; IETF HASMAT list
>> Subject: Re: [HASMAT] HSTS Threat prevalence
>>
>> >>
> One easy approach we considered was thinking of likely places for these types of attacks, and seeing if w can detect them.  One easy example is airports. Look for wifi in an airport and you'll usually see quite a number of "free wifi" SSIDs, all with slightly carrying names.  Who knows which one is the real one.  I'd like to do a little experimenting on how many of those are rogue.
>
> - Andy
>

---

From: "Steingruebl, Andy" <[email-masked]>
Date: Fri, 6 Aug 2010 16:29:45 -0600

> Sent: Friday, August 06, 2010 3:27 PM
> To: Steingruebl, Andy
> Cc: Marsh Ray; IETF HASMAT list
> > One easy approach we considered was thinking of likely places for these
> types of attacks, and seeing if w can detect them.  One easy example is
> airports. Look for wifi in an airport and you'll usually see quite a number of
> "free wifi" SSIDs, all with slightly carrying names.  Who knows which one is
> the real one.  I'd like to do a little experimenting on how many of those are
> rogue.
> >
> 

Sorry, that was what I meant in this case by "rogue".

---

From: "Steingruebl, Andy" <[email-masked]>
Date: Fri, 6 Aug 2010 12:52:19 -0600

- Andy

---

From: "Steingruebl, Andy" <[email-masked]>
Date: Fri, 6 Aug 2010 16:23:23 -0600

- Andy