Breaking Out HSTS (and HPKP) On Firefox, IE/Edge and (Possibly) Chrome
summary
Demonstrates reproducible attacks that make browsers forget or ignore HSTS/HPKP by stuffing their stores: a JavaScript + mitm flow fills Firefox's 24-slot HSTS table to evict real entries (uses Bettercap and DeLorean to increment fake visit scores), and an HTTP header flood that bloats Chrome's JSON file to hundreds of megabytes so it becomes unusable; shows IE/Edge HSTS lives in an opaque ESA DB and cache-clears break protection. Tools, counts, and working demos are shown.
AI-written summary · about
chapters (8)
- 0:00Start
- 5:02HPKP-Certificate Pinning
- 16:35Attack improvement... defeating FF's score system
- 21:04FF's highlights - Pros
- 31:18The curious thing...
- 33:59Landing issues...
- 37:06IE/Edge highlights
- 37:44Conclusions...
related talks
46mBypassing HTTP Strict Transport Security
40mHostile JavaScript: Attacking and Defending the Browser
43mAbusing Bleeding Edge Web Standards for Appsec Glory
45mHTTP Desync Attacks: Smashing Into The Cell Next Door
33mHacking The Front-End
53mThe BEAST Wins Again: Why TLS Keeps Failing to Protect HTTP
44mCrippling HTTPs With Unholy PAC
44mDefeating Firefox