Detection of man-in-the-middle in HTTPS transactions independent of certificate trust chain

1. A method of detecting a man-in-the-middle (MITM) during HTTPS communications, the method implemented by at least one processor comprising hardware, the method comprising:

transmitting a query to a DNS for an IP address of a domain name;

receiving, from the DNS, the IP address of the domain name;

generating an alternate IP address different than the IP address of the domain name;

transmitting a TCP message to the alternate IP address;

receiving a TCP acknowledgement message from the alternate IP address;

establishing a TCP connection with the alternate IP address in response to the received TCP acknowledgment;

transmitting a TLS message using the TCP connection, a SNI of the TLS message including the domain name;

receiving a TLS reply message including a certificate for the domain name;

validating the received certificate;

establishing a TLS connection in response to validation of the received certificate;

transmitting a HTTP GET message using the TLS connection, a URL of the HTTP GET message including the domain name and a target web page associated with the domain name;

receiving a HTTP OK message including the target web page; and

determining that a man-in-the-middle is intercepting the HTTPS communications based on the receipt of the target web page.

2. The method of claim 1 , further comprising presenting an indication to a user via a display that a man-in-the-middle is intercepting the HTTPS communications based on the determination.

3. The method of claim 1 , wherein the alternate IP address is generated by scrambling the numbers in the received IP address of the domain name.

4. The method of claim 1 , further comprising:

transmitting a second TCP message to the IP address of the domain name;

receiving a second TCP acknowledgement message from the IP address of the domain name;

establishing a second TCP connection in response to the received second TCP acknowledgment;

transmitting a second TLS message using the second TCP connection, a SNI of the second TLS message including the domain name;

receiving a second TLS reply message including a certificate for the domain name;

validating the certificate received with the second TLS reply message for the domain name;

establishing a second TLS connection in response to validation of the certificate received with the second TLS reply message;

transmitting a second HTTP GET message using the second TLS connection, a URL of the second HTTP GET message including an alternate domain name and a second target web page associated with the alternate domain name, the alternate domain name being different from the domain name; and

receiving a second HTTP OK message including the second target web page,

wherein the determination that a man-in-the-middle is intercepting the HTTPS communications is also based on the receipt of the second target web page.

5. A method of detecting a man-in-the-middle (MITM) during HTTPS communications, the method implemented by at least one processor comprising hardware, the method comprising:

establishing a TCP connection to an IP address of a domain name;

transmitting a TLS message using the TCP connection, a SNI of the TLS message including the domain name;

receiving a TLS reply message including the certificate for the domain name;

validating the received certificate;

establishing a TLS connection in response to validation of the received certificate;

transmitting a HTTP GET message using the TLS connection, a URL of the HTTP GET message including an alternate domain name and a target web page associated with the alternate domain name, the alternate domain name being different from the domain name;

receiving a HTTP OK message including the target web page; and

determining that a man-in-the-middle is intercepting the HTTPS communications based on the receipt of the target web page.

6. The method of claim 5 , further comprising presenting an indication to a user via a display that a man-in-the-middle is intercepting the HTTPS communications based on the determination.

7. The method of claim 5 , wherein establishing the TCP connection comprises:

transmitting a query to a DNS for the IP address of a domain name;

receiving, from the DNS, the IP address of the domain name;

transmitting a TCP message to the IP address of the domain name;

receiving a TCP acknowledgement message from the IP address of the domain name; and

establishing a TCP connection in response to the received TCP acknowledgment.

8. The method of claim 5 , wherein establishing the TCP connection comprises:

transmitting a query to a DNS for an IP address of a domain name;

receiving, from the DNS, the IP address of the domain name;

generating an alternate IP address that is different from the IP address of the domain name;

transmitting a TCP message to the alternate IP address;

receiving a TCP acknowledgement message from the alternate IP address; and

establishing the TCP connection with the alternate IP address in response to receipt of the TCP acknowledgment message.

9. The method of claim 5 , further comprising:

generating an alternate IP address different than the IP address of the domain name;

establishing a second TCP connection to the alternate IP address;

transmitting a second TLS message using the second TCP connection, a SNI of the second TLS message including the domain name;

receiving a second TLS reply message including a certificate for the domain name;

validating the certificate received with the second TLS reply message;

establishing a second TLS connection in response to validation of the certificate received with the second TLS reply message;

transmitting a second HTTP GET message using the second TLS connection, a URL of the second HTTP GET message including the domain name and a second target web page associated with the domain name; and

receiving a second HTTP OK message including the second target web page,

wherein the determination that a man-in-the-middle is intercepting the HTTPS communications is also based on the receipt of the second target web page.

10. The method of claim 9 , wherein the alternate IP address is generated by scrambling the numbers in the IP address of the domain name.

11. A method of detecting a man-in-the-middle (MITM) during HTTPS communications, the method implemented by at least one processor comprising hardware, the method comprising:

establishing a TCP connection to an IP address of a domain name;

generating an alternate domain name using a domain generation algorithm;

transmitting a TLS message using the TCP connection, a SNI of the TLS message including the generated alternate domain name;

receiving a TLS reply message including a certificate for the generated alternate domain name; and

determining that a man-in-the-middle is intercepting the HTTPS communications based on the receipt of the certificate, and

said method further comprising:

establishing a TLS connection in response to receipt of the certificate;

transmitting a HTTP GET message using the TLS connection, a URL of the HTTP GET message including the domain name and a target web page associated with the domain name; and

receiving a HTTP OK message including the target web page,

wherein the determination that a man-in-the-middle is intercepting the HTTPS communications is also based on the receipt of the target web page.

12. The method of claim 11 , further comprising presenting an indication to a user via a display that a man-in-the-middle is intercepting the HTTPS communications based on the determination.

13. The method of claim 11 , wherein the generated alternate domain name has a high level of entropy.

14. The method of claim 11 , wherein establishing the TCP connection comprises:

transmitting a query to a DNS for an IP address of a domain name;

receiving, from the DNS, the IP address of the domain name;

transmitting a TCP message to the IP address of the domain name;

receiving a TCP acknowledgement message from the IP address of the domain name; and

establishing the TCP connection with the IP address in response to receipt of the TCP acknowledgment message.

15. The method of claim 11 , wherein establishing the TCP connection comprises:

transmitting a query to a DNS for an IP address of a domain name;

receiving, from the DNS, the IP address of the domain name;

generating an alternate IP address that is different from the IP address of the domain name;

transmitting a TCP message to the alternate IP address;

receiving a TCP acknowledgement message from the alternate IP address; and

establishing the TCP connection with the alternate IP address in response to receipt of the TCP acknowledgment message.

16. The method of claim 11 , further comprising:

establishing a TLS connection in response to receipt of the certificate;

transmitting a HTTP GET message using the TLS connection, a URL of the HTTP GET message including the an alternate domain name and a target web page associated with the alternate domain name, the alternate domain name being different than the domain name; and

receiving a HTTP OK message including the target web page,

wherein the determination that a man-in-the-middle is intercepting the HTTPS communications is also based on the receipt of the target web page.