The Evil Alt-Ego: (ab)using HTTP Alternative Services
summary
HTTP Alt-Svc lets a site tell browsers to fetch content from an equivalent endpoint; researchers demonstrate five attacks that exploit that behavior: browser-driven port scanning (notably CVE-2019-11728), distributed scanning/DDoS, history/tracking exfiltration, and a malware bypass that remains unpatched. They build a demo server that scans arbitrary IP:port via victim browsers, show localhost and private-network scans succeed, and confirm Firefox/Tor patched port-scan/DDoS while malware-scanner evasion still works; mitigations: block sensitive ports, validate Alt-Svc domains, isolate Alt-Svc cache.
AI-written summary · about
chapters (12)
- 0:00Start
- 7:56The Anatomy of an Alt Services Header
- 8:38Load Balancing
- 9:07Five Vulnerabilities of Alternative Services
- 9:36Distributed Denial of Service
- 10:33Case Models
- 16:20Timing Side Channel Analysis
- 20:52Distributed Port Scanning
- 22:00Demo
- 24:01Malware Protection Bypass
- 24:26Safe Browsing
- 32:32Conclusion
related talks
01h 04mServer-Side Browsing Considered Harmful
45mHTTP Desync Attacks: Smashing Into The Cell Next Door
44mCache Me If You Can: Messing with Web Caching
42mModern web application bugs
33mHacking The Front-End
50mHTTP Desync Attacks: Smashing into the Cell Next Door
40mHostile JavaScript: Attacking and Defending the Browser
56mModern Web Vulnerabilities 2020