SSL stripping In a 2009 paper, Marlinspike introduced the concept of
SSL stripping, a
man-in-the-middle attack in which a network attacker could prevent a
web browser from upgrading to an SSL connection in a way that would likely go unnoticed by a user. He also announced the release of a tool, sslstrip, that would automatically perform these types of man-in-the-middle attacks. The
HTTP Strict Transport Security (HSTS) specification was subsequently developed to combat these attacks.
SSL implementation attacks Marlinspike has discovered a number of different
vulnerabilities in popular SSL implementations. Notably, he published a 2002 paper on exploiting
SSL/TLS implementations that did not correctly verify the
X.509 v3 "BasicConstraints" extension in
public key certificate chains. This allowed anyone with a valid CA-signed certificate for any
domain name to create what appeared to be valid CA-signed certificates for any other domain. The vulnerable SSL/TLS implementations included the
Microsoft CryptoAPI, making
Internet Explorer and all other Windows software that relied on SSL/TLS connections vulnerable to a man-in-the-middle attack. In 2011, the same vulnerability was discovered to have remained in the SSL/TLS implementation on
Apple Inc.'s
iOS. Also notably, Marlinspike presented a 2009 paper in which he introduced the concept of a null-prefix attack on SSL certificates. He revealed that all major SSL implementations failed to properly verify the Common Name value of a certificate, so that they could be tricked into accepting forged certificates by embedding
null characters into the CN field.
Solutions to the CA problem In 2011, Marlinspike presented a talk, "SSL And The Future Of Authenticity", at the
Black Hat security conference in
Las Vegas. He outlined many of the problems with
certificate authorities and announced the release of a software project called
Convergence to replace them. In 2012, Marlinspike and Perrin submitted an
Internet Draft for TACK, which is designed to provide SSL
certificate pinning and help solve the CA problem, to the
Internet Engineering Task Force.
Cracking MS-CHAPv2 In 2012, Marlinspike and
David Hulton presented research that makes it possible to reduce the security of
MS-CHAPv2 handshakes to a single
DES encryption. Hulton built hardware capable of cracking the remaining DES encryption in less than 24 hours, and the two made the hardware available for anyone to use as an Internet service.
Mobily surveillance controversy In 2013, Marlinspike published emails on his blog that he claimed were from Saudi Arabian telecom service
Mobily soliciting his help in surveilling their customers, including intercepting communications running through various applications. Marlinspike refused to help, making the emails public instead. Mobily denied the allegations. "We never communicate with hackers", the company said. == Traveling ==