网关模式下的ssl攻击原理与防范_罗轶.pdf

学术研究 Academic Research * 网关模式下的SSL攻击原理与防范 罗 轶，黄 征 ( 上海交通大学信息安全工程学院，上海 200240) [ 摘 要 ] 安全套接层 SSL 协议是实现互联网通信安全的关键协议，一般用于传输敏感数据，由于对信息进行加密和认 证，因此安全性很高。SSL 攻击一般是通过中间人攻击伪造 X.509 证书，但浏览器会弹出警告框，最近一种更具隐蔽性 的 SSL 会话劫持方式避免了这问题。介绍了该攻击方式的原理，并演示在局域网环境中利用 SSLStrip 工具结合 ARP 欺 骗获取 Gmail 用户信息的方法，并对 Firefox 和 Chrome 进行了安全测试，指出了通过浏览器进行 SSL 会话的安全隐患， 最后提供了相关的防范措施 . [ 关键词 ] SSL 协议；ARP 欺骗；SSLStrip；中间人攻击 [ 中图分类号 ] TP309 [ 文献标识码 ] A [ 文章编号 ] 1009-8054 (2011)04-0050-03 Principle and Prevention of SSL Attack In Gateway Mode* LUO Yi，HUANG Zheng (School of Information Security Engineering，Shanghai Jiaotong University，Shanghai 200240，China) [Abstract]SSL protocol，a key protocol in achieving Internet communication security，is generally used for transmission of sensitive data. It is of high security for its encryption and authentication of the sensitive data. The usual method for SSL attack is to forge X.509 certificates based on Man-in-the-Middle，however there are usually warning indicators in the browser. Recently，a hidden and better method for SSL attack could avoid this warning. The paper describes the principle of SSL attack，the demonstration of SSLStrip in acquiring the password of Gmail in the LAN environment. Meanwhile the safety tests on Firefox and Chrome are done，and finally some preventive measures against SSL attack are also provided. [Keywords] SSL(secure socket protocol)；ARP redirection；SSLStrip；man-in-the-middle attack 证书进行的，比如SSLSniff软件，但会在客户端浏览器弹框示警。 0 引言 随着研究深入，最近出现了一款SSLStrip软件，