key: 2013-truncation-attacks-to-violate-beliefs
type: inproceedings
title: Truncating TLS Connections to Violate Beliefs in Web Applications
authors:
  - Ben Smyth
  - Alfredo Pironti
year: 2013
month: 6
booktitle: "WOOT'13: 7th USENIX Workshop on Offensive Technologies"
publisher: USENIX Association
note: (First appeared at Black Hat USA 2013.)
description: >-
  We identify logic flaws to: cast votes on behalf of honest voters in e-voting, take full control
  of Microsoft accounts, and temporary access to Google accounts.
keywords: >-
  attack, exploit, vulnerability, Google, Gmail, YouTube, Hotmail, Microsoft, Live, Helios, logic
  flaw, sign-out, single-sign-on, TLS truncation, web application
abstract: >-
  <p>We identify logical web application flaws which can be exploited by TLS truncation attacks to
  desynchronize the user- and server-perspective of an application's state. It follows immediately
  that servers may make false assumptions about users, hence, the flaw constitutes a security
  vulnerability. Moreover, in the context of authentication systems, we exploit the vulnerability to
  launch the following practical attacks: we exploit the Helios electronic voting system to cast
  votes on behalf of honest voters, take full control of Microsoft Live accounts, and gain temporary
  access to Google accounts. </p>
extra: "<h2>Acknowledgement from Google and Microsoft</h2>\n\t\t<p>Our contribution has been acknowledged in Google's <a href=\"http://www.google.com/about/appsecurity/hall-of-fame/distinction/\">Hall of Fame</a> and\n\t\t\tMicrosoft's <a href=\"http://technet.microsoft.com/en-us/security/cc308575\">Security Researcher Acknowledgements</a>.\n\t\t</p>\n\n\t\t<h2>Media coverage</h2>\n\t\t<p>\n\t\t\tThis article has been discussed by <a href=\"http://www.theregister.co.uk/2013/08/01/gmail_hotmail_hijacking/\">The Register</a> (<a href=\"/files/Smyth13-truncation-attacks-to-violate-beliefs-Register-coverage.pdf\">local cache</a>) and <a href=\"http://www.spiegel.de/netzwelt/web/black-hat-2013-https-verschluesselung-unter-beschuss-a-914481.html\">Spiegel Online</a> (<a href=\"/files/Smyth13-truncation-attacks-to-violate-beliefs-Spiegel-coverage.pdf\">local cache</a>).\n\t\t</p>\n\n\t\t<h2>Talk and video demonstrations</h2>\n\t\t<p>Our <a href=\"http://youtu.be/CpL1bJiAtXI\">Black Hat talk</a> and videos demonstrating our attacks against  \n\t\t\t<a href=\"http://youtu.be/Ux_gE_6RuvU\">Google</a>,\n\t\t\t<a href=\"http://youtu.be/BsdjoVZ8xQA\">Helios</a> \n\t\t\tand <a href=\"http://youtu.be/nyx8FnhCq7g\">Microsoft</a> are available on YouTube:\t\t\n\t\t</p>\n\n\t\t<iframe width=\"320\" height=\"200\" src=\"//www.youtube-nocookie.com/embed/CpL1bJiAtXI?rel=0\" frameborder=\"0\" allowfullscreen></iframe>\n\t\t<iframe width=\"320\" height=\"200\" src=\"//www.youtube-nocookie.com/embed/nyx8FnhCq7g?rel=0\" frameborder=\"0\" allowfullscreen></iframe>\n\t\t<iframe width=\"320\" height=\"200\" src=\"//www.youtube-nocookie.com/embed/BsdjoVZ8xQA?rel=0\" frameborder=\"0\" allowfullscreen style=\"margin-bottom: 20px;\"></iframe>\n\t\t<iframe width=\"320\" height=\"200\" src=\"//www.youtube-nocookie.com/embed/Ux_gE_6RuvU?rel=0\" frameborder=\"0\" allowfullscreen style=\"margin-bottom: 20px;\"></iframe>\n"
supersededby:
  - key: 2014-truncation-attacks-to-violate-beliefs
    text: INRIA Archive version
links:
  - file: Smyth13-truncation-attacks-to-violate-beliefs.pdf
    text: Extended version