4 ms·

No details about this attack have been made available to anyone who can publicly corroborate them, and yet the researchers are doing press interviews and speaki

by moxie 15y ago

No details about this attack have been made available to anyone who can publicly corroborate them, and yet the researchers are doing press interviews and speaking publicly about how they've broken SSL. I have no idea what the details of this attack are, but in my experience, when people hype an exploit for weeks before making details available, it's because the exploit isn't really very good. I realize that the security industry is built on hype, but this is fucking dumb.

marshray 15y ago
I agree their disclosure strategy pretty effed up. Nevertheless, if BEAST is basically an exploit on the Bard attack that's been known for years, perhaps it suggests that there was an insufficiency of hype around the original publication.
- skeptical 15y ago
  I would go further and say anyone can claim they "broke" whatever system. Why do we even care about this. PoC or it didn't happen. Also, 'SSL broken' it's a way abusive title to whatever hack relying on non encrypted http requests, javascript injection and so on. But the real question: why do people pay so much attention to this here at HN? Why does it gets discussed as if would be given for a fact when all we have are rumors? I think people just like to talk vaguely about crypto, throwing a few concepts and hypothesis around migt be enough for many to feel intelligent...?
  - marshray 15y ago
    Duong and Rizzo have a proven track record. The demo is scheduled for Friday http://www.ekoparty.org/2011/juliano-rizzo.php http://www.ekoparty.org/2011/juliano-rizzo.php
- moxie 15y ago
  Maybe, we don't know. I'm guessing that @agl can't respond in detail, because he's likely bound by whatever disclosure agreement the Chrome team entered into, but he's a smart cookie and I'm inclined to trust his assessment. I obviously have no way to know whether this is a big deal or not. These guys have a "proven track record" from the ASP.net thing, but remember that attack came after a number of less-than-earth-shattering releases from them around padding oracles in other circumstances.
  - marshray 15y ago
    Yeah. But something that might look like an insignificant corner case to a browser vendor might mean that your own SSL/TLS app is 100% pwned. These guys need to publish the details now. Let the baby be born and not try to prolong the delivery for their own personal reasons.
  - aortega 15y ago
    > but remember that attack came after a number of less-than-earth-shattering releases from them around padding oracles in other circumstances. So, that attack is less valid because it was gradually developed. That phrase doesn't make any sense.
pvarangot 15y ago
A demo is due on Friday, that's hardly a "weeks" timeframe. Browser vendors have been contacted, and and far as I've been reading details given on interviews by Juliano and Thai are straight to the point. The hyping up is being done by journalists, and by people on the security-conference biz (Dragos, i'm looking at you...), those are businesses relying on hype, not security itself. I find you own attitude on the mater as a security researcher rather unprofessional. I beleive you are speculating hardly on this not being a serious matter, and are in fact as detail-less as the journalists hyping this up.
- moxie 15y ago
  They've been talking about it on twitter for weeks before this.
anologwintermut 15y ago
The hype is indeed a little absurd. But look at it another way: Bard's paper enumerated a very potential exploit i 5 years ago .Issues with the IV were disclosed on the openssl list 3 years before that. For the past 8 years TLS was know to be theoretically insecure and yet the fix was not widely adopted. I would have hoped we had outgrown ignoring "academic" issues with crypto systems after the debacle with non provably secure RSA signatures in SSL/the Bleichenbacher attack that necessitated OAEP in the 90s. Maybe the security community deservers the world it lives in where this kind of hype is acceptable and productive? Certainly it could have been avoided by paying attention to these issues in the first place.
- moxie 15y ago
  Hah, fair enough.

by moxie 15y ago

marshray 15y ago

I agree their disclosure strategy pretty effed up. Nevertheless, if BEAST is basically an exploit on the Bard attack that's been known for years, perhaps it suggests that there was an insufficiency of hype around the original publication.

skeptical 15y ago
I would go further and say anyone can claim they "broke" whatever system. Why do we even care about this. PoC or it didn't happen. Also, 'SSL broken' it's a way abusive title to whatever hack relying on non encrypted http requests, javascript injection and so on. But the real question: why do people pay so much attention to this here at HN? Why does it gets discussed as if would be given for a fact when all we have are rumors? I think people just like to talk vaguely about crypto, throwing a few concepts and hypothesis around migt be enough for many to feel intelligent...?
- marshray 15y ago
  Duong and Rizzo have a proven track record. The demo is scheduled for Friday http://www.ekoparty.org/2011/juliano-rizzo.php http://www.ekoparty.org/2011/juliano-rizzo.php
moxie 15y ago
Maybe, we don't know. I'm guessing that @agl can't respond in detail, because he's likely bound by whatever disclosure agreement the Chrome team entered into, but he's a smart cookie and I'm inclined to trust his assessment. I obviously have no way to know whether this is a big deal or not. These guys have a "proven track record" from the ASP.net thing, but remember that attack came after a number of less-than-earth-shattering releases from them around padding oracles in other circumstances.
- marshray 15y ago
  Yeah. But something that might look like an insignificant corner case to a browser vendor might mean that your own SSL/TLS app is 100% pwned. These guys need to publish the details now. Let the baby be born and not try to prolong the delivery for their own personal reasons.
- aortega 15y ago
  > but remember that attack came after a number of less-than-earth-shattering releases from them around padding oracles in other circumstances. So, that attack is less valid because it was gradually developed. That phrase doesn't make any sense.

pvarangot 15y ago

A demo is due on Friday, that's hardly a "weeks" timeframe. Browser vendors have been contacted, and and far as I've been reading details given on interviews by Juliano and Thai are straight to the point. The hyping up is being done by journalists, and by people on the security-conference biz (Dragos, i'm looking at you...), those are businesses relying on hype, not security itself. I find you own attitude on the mater as a security researcher rather unprofessional. I beleive you are speculating hardly on this not being a serious matter, and are in fact as detail-less as the journalists hyping this up.

moxie 15y ago
They've been talking about it on twitter for weeks before this.

anologwintermut 15y ago

The hype is indeed a little absurd. But look at it another way: Bard's paper enumerated a very potential exploit i 5 years ago .Issues with the IV were disclosed on the openssl list 3 years before that. For the past 8 years TLS was know to be theoretically insecure and yet the fix was not widely adopted. I would have hoped we had outgrown ignoring "academic" issues with crypto systems after the debacle with non provably secure RSA signatures in SSL/the Bleichenbacher attack that necessitated OAEP in the 90s. Maybe the security community deservers the world it lives in where this kind of hype is acceptable and productive? Certainly it could have been avoided by paying attention to these issues in the first place.

moxie 15y ago
Hah, fair enough.