Bypassing HTTP Strict Transport Security
summary
Shows that HSTS can be bypassed by shifting the client clock forward via spoofed NTP responses, letting HTTPS policies expire and enabling SSLStrip-style downgrades. Demonstrates a proof‑of‑concept tool called DeLorean NTP spoofing that answers time requests with future dates; live demos work on macOS and many Linux setups but success depends on OS sync behavior and network access. Notes that the HSTS preload is not infinite — preloaded list = 1000 days in Chromium — while Safari INF = forever behaves differently.
AI-written summary · about
chapters (11)
- 0:00Introduction
- 2:29SSL bypass techniques overview
- 5:45Stripping attacks and HSTS basics
- 9:03HSTS mechanics and preload list
- 14:30HSTS implementation weaknesses
- 17:47Time machine concept for HSTS
- 23:56DeLorean tool demo
- 33:11OS time sync vulnerabilities
- 36:25Windows time sync attacks
- 41:08NTP attacks responsibility and fixes
- 44:11Q&A
related talks
46mBreaking Out HSTS (and HPKP) On Firefox, IE/Edge and (Possibly) Chrome
53mThe BEAST Wins Again: Why TLS Keeps Failing to Protect HTTP
36mHTTPS Is Not Enough
37mHTTPS Is Better than Ever Before. Now Its Your Turn.
53mHansel and Gretel do TLS
45mHTTP Desync Attacks: Smashing Into The Cell Next Door
44mCrippling HTTPs With Unholy PAC
40mHTTP Headers for the Responsible Developer