Last Updated on May 24, 2015

Approximately one year ago Juliano Rizzo and Thai Duong (the so-called BEASTie Boys) discovered a way to break SSL Encryption by mean of their BEAST attack (Browser Exploit Against SSL/TLS).

Their attack exploited a design flaw of the SSL/TLS 1.0 protocols (or better of the CBC cipher-suites, such as AES and 3DES), allowing to decrypt an encrypted conversation by sniffing the traffic and injecting a known pattern in the encryption channel. At that time the research had a considerable impact, given the wide usage of SSL/TLS in millions of websites providing secure online services.

As TLS 1.2 was not vulnerable, it was told, when possible, to migrate to this version of the protocol, but since its adoption is still far from being common, it was suggested, as Google did, to use a cipher not involving CBC mode, as for instance RC4.

After one year, at the Ekoparty Conference in Argentina, the two researchers are going to unveil a new attack against SSL/TLS dubbed CRIME. Few details are currently available: the two researchers are not revealing exactly which feature of SSL/TLS is responsible for the CRIME Attack (except that the specific feature used in this attack has not been a major subject of security research until now). In any case the new attack works much like the BEAST attack: once they have a man-in-the-middle position on a given network, they can sniff HTTPS traffic and launch the attack.

The bad news is that all versions of TLS (including 1.2) are vulnerable, and is not dependant on the cipher-suite adopted. Furthermore, according to the few information available, the exploits uses JavaScript code to make the attack faster, but in theory it could work also with static HTML, by loading JavaScript into the victim’s browser from a separate site.

The good news is that, although both Mozilla Firefox and Google Chrome are vulnerable to the attack. the browser vendors have developed patches for the issue that will be released in the next few weeks.

This Post Has 4 Comments

  1. Disposable Razor

    OK, so tell me what strings I need to search for, using sslscan, to identify which of my hundreds of SSL servers, will need new certificates issued?

  2. Alan Drabke

    This is exactly what I’m looking for in a daily bulletin on the subject of computer hacking. Thanks!

Leave a Reply

This site uses Akismet to reduce spam. Learn how your comment data is processed.