HTTPS Exploit showcased at BlackHat

[Crion]

Happened last week but no one posted anything about it.  

 

Basically, the gist of it is that this attack can extract things like social security numbers, usernames, email-addresses, and passwords from HTTPS encrypted streams regardless of the cipher used by exploiting the compression algorithms used by almost every web server.  It doesn't completely decrypt the stream, but it can expose enough information where it doesn't matter.

 

My take, we've known that SSL is in dire need of a massive update on how it works or a complete replacement for a long time.  More exploits like this just hasten its death.  

 

Source: http://arstechnica.com/security/2013/08/gone-in-30-seconds-new-attack-plucks-secrets-from-https-protected-pages/

Source: https://media.blackhat.com/us-13/US-13-Prado-SSL-Gone-in-30-seconds-A-BREACH-beyond-CRIME-WP.pdf

 

 

[Bluejay0]

@LinusTech @Slick @Windspeed36

 

 

CLOSE THE GATES!!!

[qwertywarrior]

LTT forums doesn't support  HTTPS to begin with

[TopWargamer]

Lovely

[stevv]

Bluejay0: CLOSE THE GATES!!!

 

qwertywarrior: LTT forums doesn't support  HTTPS to begin with

 

TopWargamer:  Lovely 

nuff said...

[mgsstar]

Guess HTTPS needs to be updated now since there are exploits in it that can affect people.

[Beskamir]

Guess HTTPS needs to be updated now since there are exploits in it that can affect people.

You mean now that people know there are exploits that could affect them. It's not like they magically appeared. These exploits existed before they were revealed much like how crossfire issues existed before frame capturing tech proved it:D

[Crion]

Guess HTTPS needs to be updated now since there are exploits in it that can affect people.

 

Security researchers have been advocating for SSL to be replaced for years.  Man-in-the-middle attacks are the most common way of exploiting SSL and the only safeguard against them are a system of trust we call the Certificate Authority system which is completely exploitable.  If you doubt it, ask Comodo (had a root CA stolen) or DigiCert (also had a root CA stolen).