3 ms·
TLS(SSL) broken != Browser Exploit Against SSL/TLS (BEAST). Please change the headline.
by dekz 15y ago
TLS(SSL) broken != Browser Exploit Against SSL/TLS (BEAST). Please change the headline.
- willvarfar 15y agoIt claims to be a practical working attack, and it says they haven't found a practical solution. The title accurately reflects how I interpret the gist of the situation.
- dekz 15y agoThis attack could only be potentially practical against web browsers, not other applications implementing TLS.
- aclimatt 15y agoThey claim to also be able to perform the attack on other applications using TLS (such as VPNs), not just web browsers.
- dekz 15y agoQuite possibly, but this is about BEAST and the ability of loading malicious Javascript. Performing the feat of code injection on a non-browser application is something completely different. If something is injecting code into your native application or throwing known plaintext into your socket streams then you've already been compromised.
- dfox 15y agoYou don't need to inject code, you need to inject traffic. Injecting code into client is only one way to do that. For example in many VPN deployments you can inject traffic into secure channel directly.
- pnathan 15y ago". We present one application the attack: BEAST. BEAST focuses on SSL implementations on browsers which is HTTPS. BEAST works for most major browsers and websites." The researchers said that the browser-based attack is just one variant. They said they also could implement a similar attack against other services that use SSL, such as instant-messaging clients or VPNs." Please read the article before flaming it.
- nknight 15y agoPlease read the article linked to by the original post, not the article linked to by another commenter. The article on The Register which was linked to says nothing about VPNs or instant messaging clients.
- tshtf 15y agoDid you read page 2 of The Register article? Duong and Rizzo said the underlying vulnerability BEAST exploits is present in virtually all applications that use TLS 1.0, making it possible to apply the technique to monitor private communications sent through many instant messenger and Virtual Private Networking programs.
- nknight 15y agoI didn't even see there was a page 2 on the Register article, so mea culpa on that (though the parent's quote was indeed not from that page, but from one another commenter linked to).
- dekz 15y agoThey can do similar by sharing a SSL(only on CBC?) socket and piping known plain-text into it. This doesn't mean TLS itself is broken.
- marshray 15y agoWell TLS is supposed to protect you from that sort of thing. They fixed it in TLS 1.1 and 1.2.