Analysis and Research on HTTPS Hijacking Attacks

摘要

With the development of e-commerce, SSL protocol is more and more widely applied to various network services. For the defect of SSL authentication, this paper analyses two kinds of drawbacks in SSL handshake, and respectively conducts fake certificate and conversion from HTTPS to HTTP data to attack. Both of them are dangerous to HTTPS communication. For that reason, we have proposed three different measures to strengthen data security, which are static ARP table, enhanced certificate system, and two-way authentication. Experimental results show that three methods are effectively defensive against the HTTPS hijacking attacks.