There is a feature supported by the SSL/TLS encryption standard and used by most of the major browsers that leaks enough information about encrypted sessions to enable attackers to decrypt users’ protected cookies and hijack their sessions.
The researchers who developed the attack that exploits this weakness say all versions of TLS suffer from the issue, including TLS 1.2, and the cipher suite used in the encrypted session makes no difference in the success of the attack.
Researchers Juliano Rizzo and Thai Duong, the same pair who last year released details of a similar attack on SSL/TLS and wrote a tool called BEAST, developed the attack which also gave them the ability to decrypt users’ cookies and hijack sessions with sensitive sites such as e-commerce or online banking sites.
That previous attack targeted a specific problem with the AES (Advanced Encryption Standard) algorithm as it implemented in TLS 1.0 and SSL 3.0 and were able to use the BEAST tool to grab encrypted cookies from active user sessions protected by SSL/TLS.
Once they had the cookie, Rizzo and Duong could return to whatever site the user was visiting and log in using her credentials. The attack caused quite a stir in the security and cryptography communities and browser vendors had to issue fixes. One of the workarounds that defeated BEAST (Browser Exploit Against SSL/TLS) was to switch from TLS 1.0 to TLS 1.2 or to switch from AES to the RC4 cipher suite. However, Rizzo said that defense won’t work against their new attack, which they’ve dubbed CRIME.
The researchers plan to present their findings at the Ekoparty conference in Argentina later this month and are not revealing exactly which feature of SSL/TLS is providing the information leak, but they said that the new attack works much like the BEAST attack. Once they have a man-in-the-middle position on a given network, they can sniff HTTPS traffic and launch the attack.
Right now, Rizzo said, Mozilla Firefox and Google Chrome are vulnerable to the attack. However, the researchers said the browser vendors have developed patches for the problem that will release in the next few weeks.
Rizzo said the specific feature in TLS that he and Duong are using in this attack has not been a major subject of security research in the past.
“The risk of implementing the feature has been superficially discussed before. However we haven’t found previous research showing how efficient an attack could be or any attempt by the authors of secure protocols to avoid the problem,” he said.