Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Attacks/Breaches

30-Second HTTPS Crypto Cracking Tool Released

BREACH testing tool reveals sites susceptible to attack that recovers plaintext information from encrypted traffic.

9 Android Apps To Improve Security, Privacy
9 Android Apps To Improve Security, Privacy
(click image for larger view)
Three researchers who discovered a crypto attack that can be used to grab sensitive information from HTTPS traffic in less than 30 seconds have released a tool to help website operators see if their systems are susceptible.

Details of the BREACH -- short for Browser Reconnaissance and Exfiltration via Adaptive Compression of Hypertext -- attack were first revealed last month at the Black Hat information security conference in Las Vegas by Salesforce.com lead product security engineer Angelo Prado, Square application security engineer Neal Harris, and Salesforce.com lead security engineer Yoel Gluck.

Their presentation triggered a Department of Homeland Security warning that "a sophisticated attacker may be able to derive plaintext secrets from the ciphertext in an HTTPS stream," and that all versions of the transport layer security (TLS) and secure sockets layer (SSL) protocols are vulnerable.

[ Here's what you can learn from the latest government security breach. Read Department Of Energy Cyberattack: 5 Takeaways. ]

The man-in-the-middle HTTPS crypto attack involves watching "the size of the cipher text received by the browser while triggering a number of strategically crafted requests to a target site," according to exploit details that the developers shared with DHS. "To recover a particular secret in an HTTPS response body, the attacker guesses character by character, sending a pair of requests for each guess. The correct guess will result in a smaller HTTPS response," said the DHS.

Prado has previously said that crafting a fix for HTTPS itself will be a "nontrivial" undertaking.

In the meantime, he and his fellow researchers this week released a tool for launching a BREACH attack for testing purposes. Their tool is available both in the form of source code and instructions, as well as a precompiled binary.

"This is intended for self-assessment only," according to the BREACH tool download page. "Don't do bad things."

To use the tool, "you will need a Windows computer or [virtual machine] to build and run the tool," Prado said in an email interview. Other requirements include the .NET 3.5+ Framework and Visual Studio 2010 or newer, for anyone who wants to modify the code, which is being hosted on GitHub. The tool has been tested with Windows 7.

When using the tool, no man-in-the-middle attack is required for testing a site. Instead, the developers recommended simply pointing the tool -- which emulates a Web client -- at encrypted HTTPS traffic, using a hosts file, which allows host names to be associated with IP addresses.

In addition to this "simple HTTP client that simulates browser behavior," the researchers promised they would release a more full-fledged, browser-based tool that website operators can use to test their susceptibility to a BREACH attack.

 

Recommended Reading:

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
Mathew
50%
50%
Mathew,
User Rank: Apprentice
9/11/2013 | 9:28:17 AM
re: 30-Second HTTPS Crypto Cracking Tool Released
Tough to say, but when DHS issues an alert, the risk isn't zero. Likely, this vulnerability could be built on by attackers in the future, so that when paired with an intrusion, they'd be able to siphon away intercepted HTTPS data, which -- because it's being sent using HTTPS -- is more likely to contain sensitive information. So this is more like a warning of dangers to come, unless fixes get made.
David F. Carr
50%
50%
David F. Carr,
User Rank: Apprentice
9/4/2013 | 10:18:48 PM
re: 30-Second HTTPS Crypto Cracking Tool Released
So how dangerous is this really?
Mathew
50%
50%
Mathew,
User Rank: Apprentice
9/4/2013 | 10:34:46 AM
re: 30-Second HTTPS Crypto Cracking Tool Released
Excellent question, I should have referred to previous reporting that included that answer: The researchers have outlined a number of mitigation possibilities, such as separating secrets from user input, or masking secrets by making them random.

These are fixes that would likely need to be implemented by website server software developers, meaning it's not going to happen immediately, either on the development or subsequent implementation front.

One caveat with the vulnerability is that an attacker would first need to infiltrate a target network to then begin sniffing traffic.
David F. Carr
50%
50%
David F. Carr,
User Rank: Apprentice
9/3/2013 | 11:59:00 PM
re: 30-Second HTTPS Crypto Cracking Tool Released
What prevention or remediation steps are site providers supposed to take? Is it the web server that needs to be secured against attack or the applications that run on top of it?
COVID-19: Latest Security News & Commentary
Dark Reading Staff 7/6/2020
Ripple20 Threatens Increasingly Connected Medical Devices
Kelly Sheridan, Staff Editor, Dark Reading,  6/30/2020
DDoS Attacks Jump 542% from Q4 2019 to Q1 2020
Dark Reading Staff 6/30/2020
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
How Cybersecurity Incident Response Programs Work (and Why Some Don't)
This Tech Digest takes a look at the vital role cybersecurity incident response (IR) plays in managing cyber-risk within organizations. Download the Tech Digest today to find out how well-planned IR programs can detect intrusions, contain breaches, and help an organization restore normal operations.
Flash Poll
The Threat from the Internetand What Your Organization Can Do About It
The Threat from the Internetand What Your Organization Can Do About It
This report describes some of the latest attacks and threats emanating from the Internet, as well as advice and tips on how your organization can mitigate those threats before they affect your business. Download it today!
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2020-15505
PUBLISHED: 2020-07-07
MobileIron Core and Connector before 10.3.0.4, 10.4.x before 10.4.0.4, 10.5.x before 10.5.1.1, 10.5.2.x before 10.5.2.1, and 10.6.x before 10.6.0.1, and Sentry before 9.7.3 and 9.8.x before 9.8.1, allow remote attackers to execute arbitrary code via unspecified vectors.
CVE-2020-15506
PUBLISHED: 2020-07-07
MobileIron Core and Connector before 10.3.0.4, 10.4.x before 10.4.0.4, 10.5.x before 10.5.1.1, 10.5.2.x before 10.5.2.1, and 10.6.x before 10.6.0.1 allow remote attackers to bypass authentication mechanisms via unspecified vectors.
CVE-2020-15507
PUBLISHED: 2020-07-07
MobileIron Core and Connector before 10.3.0.4, 10.4.x before 10.4.0.4, 10.5.x before 10.5.1.1, 10.5.2.x before 10.5.2.1, and 10.6.x before 10.6.0.1 allow remote attackers to read files on the system via unspecified vectors.
CVE-2020-15096
PUBLISHED: 2020-07-07
In Electron before versions 6.1.1, 7.2.4, 8.2.4, and 9.0.0-beta21, there is a context isolation bypass, meaning that code running in the main world context in the renderer can reach into the isolated Electron context and perform privileged actions. Apps using "contextIsolation" are affecte...
CVE-2020-4075
PUBLISHED: 2020-07-07
In Electron before versions 7.2.4, 8.2.4, and 9.0.0-beta21, arbitrary local file read is possible by defining unsafe window options on a child window opened via window.open. As a workaround, ensure you are calling `event.preventDefault()` on all new-window events where the `url` or `options` is not ...