2
$\begingroup$

I have read this article about the CRIME attack against TLS and SPDY. The article says that:

What is not yet clear is how the attacker is including their input in the source material before it gets compressed and encrypted.

And this is my question: How does the attacker include their input before compression and encryption?

Also, I have the feeling that this is an inconsistency: If the attacker can insert their input before compression and encryption in TLS, isn't it necessary that the attacker is the real client itself?

Please explain what I am missing here in order to understand the CRIME attack.

$\endgroup$
2
$\begingroup$

Malicious JavaScript could trigger calls against any SSL server. Although this JavaScript is not able to actually read the cookie for that server directly, the browser will send that cookie through the SSL tunnel.

The JavaScript will then alter the URL, keeping the server but changing the path or request parameters. In that way it can inject data before compression and try to identify parts of the cookie.

$\endgroup$
  • $\begingroup$ And how can such a malicious JavaScript then read the compressed and encrypted data sent over the tunnel? Or is the attacker both a malicious JavaScript and a MITM which then listens to the data sent over the connection? $\endgroup$ – MinecraftShamrock Feb 15 '15 at 13:39
  • $\begingroup$ The attack expects, that the attacker can capture the encrypted data, e.g. by sitting in the same open WLAN as the attacked system or by rerouting the traffic e.g. through ARP spoofing. $\endgroup$ – Thor Feb 15 '15 at 13:41
  • $\begingroup$ So a single JavaScript can't do that? $\endgroup$ – MinecraftShamrock Feb 15 '15 at 13:42
  • $\begingroup$ If you don't have access to the systems traffic, it will not work. $\endgroup$ – Thor Feb 15 '15 at 13:43
  • $\begingroup$ cool, thank you. And TLS protects against ARP spoofing using certificates and against listening to the conneciton because of encryption, right? So if the attacked client does not allow the malicious script to access the network traffic, the attack is not possible? $\endgroup$ – MinecraftShamrock Feb 15 '15 at 13:45

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.