BEAST authors have developed a new method of hacking HTTPS

Posted: September 8, 2012 in Vulnerability News
Tags: , ,

Hackers attackResearchers Juliano Rizzo and Thai Duong are going to present a new method for breaking HTTPS during a conference Ekoparty in Argentina.

Security researchers Juliano Rizzo and Thai Duong declare that they have developed a new method for decoding session cookie to HTTPS (Hypertext Transfer Protocol Secure) connections.

Web-page uses the session cookie to remember the user authenticated. If an attacker can gain access to the session cookie of the user, the user will be able to take control of their account. Encrypted HTTPS connection is intended to prevent the introduction into the session, but Rizzo and Duong argue that uncovered a new way to bypass the security of the protocol.

Their method, called CRIME, will be presented this month at a conference on information security Ekoparty in Argentina.

According to ComputerWorld, the newly developed method of attack exploits a gap in the functions of cryptographic protocols TLS and SSL, which are used in HTTPS. This gap extends to all modern versions of cryptographic protocols.

For a successful attack CRIME code to be loaded into the victim’s browser, which can be done by, for example, sending a phishing message that redirects the user to the attacker-controlled web-page.

To speed up the code CRIME, it uses JavaScript, but can also do without the third-party browser plug-ins in the target system.

Recall that last year, Juliano Rizzo and Thai Duong already provides a tool that allows you to decrypt a relatively fast HTTPS protocol, called the BEAST, but it spread to the old version of TLS and SSL, as well as the required that was in the victim’s browser plugin installed Java.

Leave a Reply

Fill in your details below or click an icon to log in:

WordPress.com Logo

You are commenting using your WordPress.com account. Log Out / Change )

Twitter picture

You are commenting using your Twitter account. Log Out / Change )

Facebook photo

You are commenting using your Facebook account. Log Out / Change )

Google+ photo

You are commenting using your Google+ account. Log Out / Change )

Connecting to %s