Defence against SSLstrip

Question

I'm looking for some recommendations for securing a server against SSLstrip. Anyone have any suggestions?

Answer 1

SSLstrip's target is not the server but the session between the user and the hijacked hop. It preys on the users' inabilities to discern between a real SSL session and a lookalike. The best mitigation, then, is making sure your users are aware of what a proper SSL connection to your website looks like: https://, don't rely on the favicon "padlock", etc.

Unfortunately, since the trouble is largely on the client side, there is not a lot you can do on the server side to fix your users' naivety. You can put some notes on your login/CC page itself directing users to check for a proper SSL connection, but who is to say that that won't be stripped out by an attacker?

One option is to use something like NoScript (or HSTS as agl mentioned).

I like to set browser.identity.ssl_domain_display to 2 in Firefox to make the SSL pages way more obvious and set network.IDN_show_punycode to true to avoid homograph attacks.

Again, these are things which have to be done on the client side, and not guaranteed to be done by your users! Assume at least some of your users don't care and will click through anything.

Answer 2

HSTS is what you want. It allows you to specify that your site should always be accessed over HTTPS and it's supported by Chrome and Firefox 4. (And, with the NoScript extension, Firefox 3 too.)

See http://dev.chromium.org/sts

Answer 3

1. Force SSL on all critical pages (preferably using an EV SSL certificate and preferably on all pages - Like PayPal - so there aren't any http pages that can be injected)

2. Educate your visitors so they know something is fishy if they receive an SSL error or switch to a different domain