Unveiling SSL/TLS MITM Hosts in the Wild

The SSL man-in-the-middle (MITM) attack uses forged X.509 certificates to impersonate each endpoint and intercept encrypted connections between clients and servers. Prior researches have revealed the prevalence of MITM attacks from SSL proxies, firewall, anti-virus, adware and malware. In this work, we design and implement a novel method to discovery suspicious SSL MITM hosts in the wild. Our results show that hosts using untrusted certificates are vulnerable to MITM attacks. We find 322,831 forged certificates, most of which are generated by TLS proxies and corporate firewalls such as Lancom System, Fortinet, Technicolor, Ubiquiti, and so on. The main reason of these forged certificates disclosed in public maybe origin from default configurations. At the end, we clarify the limitations of our method and give suggestions to defend against SSL MITM attacks.