论文标题
探索HTTPS安全矛盾：跨区域的视角
Exploring HTTPS Security Inconsistencies: A Cross-Regional Perspective
论文作者
论文摘要
如果位于不同地理位置（区域）的两个或更多相同的HTTPS客户端向同一域（例如example.com）提出HTTPS请求，同一天，他们是否会收到相同的HTTPS安全保证？我们的结果证明情况并非总是如此。我们对互联网上访问量最高的25万个访问域进行扫描，来自位于五个不同地区的客户：澳大利亚，巴西，印度，英国和美国。我们的扫描从应用程序（URL和HTTP标头）和运输（服务器选定的TLS版本，密码和证书）层收集数据。总体而言，我们发现应用层的HTTPS不一致高于运输层的HTTPS不一致。我们还发现，HTTPS安全矛盾与区域之间的URL和IPS多样性密切相关，并且在较小程度上与重定向的存在程度较小。进一步的手动检查表明，使用不同的子域，不同的TLD或不同的主页文档，例如将URL多样性（例如将其降低到平原HTTP协议）之间的URL多样性背后的原因有很多。此外，我们发现降级到平原HTTP与网站的区域阻塞有关。我们还提供攻击场景，以表明攻击者如何从HTTPS安全矛盾中受益，并引入新的攻击方案，我们称之为“区域混乱”攻击。最后，根据我们的分析和观察，我们提供了讨论，其中包括一些建议，例如为域管理员和用户进行测试工具的需求，这些建议有助于减轻和检测区域域的不一致，标准化区域域格式，以相同的原始策略（域的）策略（在域的同一）中，并在可能的情况下进行标准化的安全网罗标准化重定向，并避免重定向。
If two or more identical HTTPS clients, located at different geographic locations (regions), make an HTTPS request to the same domain (e.g. example.com), on the same day, will they receive the same HTTPS security guarantees in response? Our results give evidence that this is not always the case. We conduct scans for the top 250,000 most visited domains on the Internet, from clients located at five different regions: Australia, Brazil, India, the UK, and the US. Our scans gather data from both application (URLs and HTTP headers) and transport (servers' selected TLS version, ciphersuite, and certificate) layers. Overall, we find that HTTPS inconsistencies at the application layer are higher than those at the transport layer. We also find that HTTPS security inconsistencies are strongly related to URLs and IPs diversity among regions, and to a lesser extent to the presence of redirections. Further manual inspection shows that there are several reasons behind URLs diversity among regions such as downgrading to the plain-HTTP protocol, using different subdomains, different TLDs, or different home page documents. Furthermore, we find that downgrading to plain-HTTP is related to websites' regional blocking. We also provide attack scenarios that show how an attacker can benefit from HTTPS security inconsistencies, and introduce a new attack scenario which we call the "region confusion" attack. Finally, based on our analysis and observations, we provide discussion, which include some recommendations such as the need for testing tools for domain administrators and users that help to mitigate and detect regional domains' inconsistencies, standardising regional domains format with the same-origin policy (of domains) in mind, standardising secure URL redirections, and avoid redirections whenever possible.
