STARTTLS is Dangerous
Hanno Böck reveals critical flaws in STARTTLS implementations across mail servers and clients, demonstrating command injection and credential theft via protocol downgrade attacks.
Summary
The Inherent Fragility of STARTTLS
The STARTTLS mechanism was designed to opportunistically upgrade plaintext application protocols (such as SMTP, IMAP, and POP3) to encrypted TLS sessions, but its design introduces severe architectural risks.
Command Injection in Mail Transfer Agents
Hanno Böck revisits classic protocol flaws—including Wietse Venema's 2011 Postfix vulnerability—showing that command injection across plaintext-to-ciphertext transitions remains pervasive in modern mail servers.
Client-Side Credential Theft
Böck reveals that widespread email clients are equally susceptible to machine-in-the-middle command injection, allowing attackers to hijack authentication sessions and harvest plaintext user credentials.
Abandoning Opportunistic Upgrades
The speaker demonstrates ambiguous and contradictory RFC specifications governing STARTTLS, arguing that the security community must deprecate STARTTLS in favor of strict implicit TLS connections.
Related talks
Main Stage·50 min
Aapo Oksman
Aapo Oksman introduces certmitm, an automated tool designed to discover and exploit insecure TLS client certificate validation flaws across iOS, Windows 11, and embedded devices.
Crypto Village·25 min
Kelley Robinson
Explores applying TLS-style cryptographic identity and encryption primitives to telephone networks to mitigate spoofing and call interception.
Presentations Crypto·50 min
Jose Selvi
Jose Selvi demonstrates how manipulating Network Time Protocol (NTP) synchronisation allows bypassing SSL/TLS certificate expiration checks and HSTS protections.