Researchers use bypass attacks to steal encrypted information

Researchers use bypass attacks to steal encrypted information

The attacks against SSL/TLS discovered in the past few years usually require attackers to be in the middle, that is, requiring them to sniff or manipulate traffic. Two security researchers reported a new method of combined bypass attacks at the Black Hat Security Conference, without man-in-the-middle sniffing traffic. This attack technology is called HEIST: HTTP Encrypted Information can be Stolen through TCP-windows (PDF ), the information contained in the encrypted response is inferred based on the vulnerability of the Cross-response packet size transmitted over the TCP layer and the lack of the plaintext information length hiding capability in SSL/TLS. Researchers can use this method to decrypt sensitive information such as the email address and social security account contained in the encrypted response. Two researchers disclosed their findings to Google and Microsoft in advance before publishing a report. They attacked by displaying malicious third-party ads on their websites. Currently, the only method to mitigate attacks is to disable third-party cookies, whereas most browsers currently accept third-party cookies by default, the researchers said.

This article permanently updates the link address: