The researcher in the field of a computer security from the Netherlands, Guido Vranken [Guido Vranken] found a new method of attack to the traffic ciphered on TLS/SSL. In the theory he allows to retrieve certain information on the data transferred on the HTTPS protocol. This information then can be used for increase of efficiency of cracking.
The attack called by the researcher of "HTTPS Bicycle Attack" (bicycle attack) allows to determine length of some data transferred in encrypted form: length of heading of kuk, length of the passwords transferred by the POST method, GPS coordinates, the addresses IPv4, etc. At the same time even the traffic which remained in logs gives in to the analysis.
However, to retrieve information on length of fields, it is necessary to foreknow length of some of transmitted data. Besides, attack works only when using the stream cipher.
Having subtracted from authentication heading length length of login, the URL address where the client, and other auxiliary information attacking will become authorized can receive the password length then attack by a trial and error method will become a little more effective.
As recommendations for administrators of resources Vranken advises to turn off stream enciphering, always to use the latest version of TLS (so far it is 1.2) and to mask the true length of the most sensitive data, supplementing them with characters which will be discarded then.
The theoretical possibility of such attack is not a reason for panic – its success requires execution of many conditions. And, of course, the users using the non-standard accidental and rather long passwords and different on different resources for the present can feel safe.
This article is a translation of the original post at geektimes.ru/post/268880/
If you have any questions regarding the material covered in the article above, please, contact the original author of the post.
If you have any complaints about this article or you want this article to be deleted, please, drop an email here: firstname.lastname@example.org.
We believe that the knowledge, which is available at the most popular Russian IT blog geektimes.ru, should be accessed by everyone, even though it is poorly translated.
Shared knowledge makes the world better.