SPDY compression and CRIME attack from Mike Belshe on 2012-09-14 ([email protected] from July to September 2012)
From: Mike Belshe <[email protected]> Date: Thu, 13 Sep 2012 20:20:49 -0700 To: httpbis mailing list <ietf[email protected]> Message-ID: <CABaLYCsAmOe7z68E25pfYsuhb8r_AsH-AbzX-VfUYK_VGWbGDg@mail.gmail.com> You may have read about the CRIME attack recently: http://security.stackexchange.com/questions/19911/crime-how-to-beat-the-beast-successor/19914#19914 http://www.cio.com/article/716161/_39_CRIME_39_
2012年11月24日 – rm -fr /*
SSLã®( ´ω｀) 証明書ã¨CipherSuiteã¨ä»–è¨å®šã‚’採点ã—ã¦ãれるサイトãŒã‚ã‚Šã¾ã™ã€‚ Qualys …
CRIME: Information Leakage Attack against SSL/TLS | Qualys Security Blog
It seems that it is that time of year again, when Juliano and Thai present their most recent attack against crypto system. Last year, it was BEAST. This year, it’s CRIME, a practical attack against how TLS is used in browsers. In a wider sense, the same attack conceptually applies to any encrypted protocol where the attacker controls what is being communicated. Initially, it was only known that th
More Details on CRIME Attack: Takes Advantage Of TLS Compression [VIDEO]
Post author:Paolo Passeri Post published:September 13, 2012 Post category:Security Post comments:2 Comments Reading time:2 mins read Last Updated on May 24, 2015 More details have been released about CRIME, the brand new attack against TLS developed by Juliano Rizzo and Thai Duong. The attack takes advantage of a flaw in the compression ratio of TLS requests wich allows the attacker to decrypt the
![More Details on CRIME Attack: Takes Advantage Of TLS Compression [VIDEO]](https://cdn-ak-scissors.b.st-hatena.com/image/square/7c4aa433c7c036963c46100b583a13589d38bdd5/height=288;version=1;width=512/https%3A%2F%2Fi0.wp.com%2Fwww.hackmageddon.com%2Fwp-content%2Fuploads%2F2021%2F01%2Fcropped-Icon512-1.png%3Ffit%3D512%252C512%26ssl%3D1)
CRIME
ã“ã®ãƒ–ラウザ ãƒãƒ¼ã‚¸ãƒ§ãƒ³ã®ã‚µãƒãƒ¼ãƒˆã¯çµ‚了ã—ã¾ã—ãŸã€‚サãƒãƒ¼ãƒˆã•ã‚Œã¦ã„るブラウザã«ã‚¢ãƒƒãƒ—グレードã—ã¦ãã ã•ã„。
CRIME : New SSL/TLS attack for Hijacking HTTPS Sessions
Two security researchers claim to have developed a new attack that can decrypt session cookies from HTTPS (Hypertext Transfer Protocol Secure) connections. From the security researchers who created and demonstrated the BEAST (Browser Exploit Against SSL/TLS) tool for breaking SSL/TLS encryption comes another attack that exploits a flaw in a feature in all versions of TLS. The new attack has been g
'CRIME' Attack Abuses SSL/TLS Data Compression Feature to Hijack HTTPS Sessions | CIO
'CRIME' Attack Abuses SSL/TLS Data Compression Feature to Hijack HTTPS Sessions SSL/TLS data compression leaks information that can be used to decrypt HTTPS session cookies, researchers say The 'CRIME' attack announced last week exploits the data compression scheme used by the TLS (Transport Layer Security) and SPDY protocols to decrypt user authentication cookies from HTTPS (HTTP Secure) traffic,
SSL/SPDYを攻撃ã™ã‚‹CRIMEã¯BEASTã®æ£çµ±ãªå¾Œç¶™è€…ã
ã¯ã˜ã‚㫠以å‰ã®ã‚¨ãƒ³ãƒˆãƒªã§SSLã«å¯¾ã™ã‚‹æ–°ã—ã„攻撃手法「BEASTã€ã‚’紹介ã—ã¾ã—ãŸãŒã€ä»Šå›žã¯BEASTã‚’ã•ã‚‰ã«ç™ºå±•ã•ã›ãŸã€ŒCRIMEã€ã¨ã„ã†æ”»æ’ƒã«ã¤ã„ã¦ç°¡å˜ã«ç´¹ä»‹ã—ãŸã„ã¨æ€ã„ã¾ã™ã€‚ä¸€æ¬¡æƒ…å ±æºã¨ã—ã¦ã“ã¡ã‚‰ã®ã‚¹ãƒ©ã‚¤ãƒ‰ï¼ˆè‹±èªžï¼‰ãŒé–²è¦§ã§ãã¾ã™ã®ã§ã€æ™‚é–“ãŒã‚ã‚‹æ–¹ã¯ãœã²ç›®ã‚’通ã—ã¦ã¿ã¦ãã ã•ã„。 CRIMEã®æ„味 CRIME㯠"Compression Ratio Info-Leak Made Easy" ã‚ã‚‹ã„㯠"Compression Ratio Info-Leak Mass Exploitation" ã®é æ–‡å—ã§ã€SSLã‚„SPDY（ã‚ã‚‹ã„ã¯HTTPボディ部ã®gzip圧縮）ã§ä½¿ã‚れる圧縮アルゴリズムã«æ³¨ç›®ã—ãŸæ”»æ’ƒæ‰‹æ³•ã§ã™ã€‚ã‚ã¾ã‚ŠçŸ¥ã‚‰ã‚Œã¦ã„ã¾ã›ã‚“ãŒSSLã«ã¯åœ§ç¸®æ©Ÿèƒ½ãŒå˜åœ¨ã—ã¦ãŠã‚Šã€ã‚µãƒ¼ãƒå´ãƒ»ã‚¯ãƒ©ã‚¤ã‚¢ãƒ³ãƒˆå´åŒæ–¹ãŒåœ§ç¸®æ©Ÿèƒ½ã‚’ONã«ã—ã¦ã„ã‚‹å ´åˆã«ã€ãƒ‡ãƒ¼ã‚¿ãŒåœ§ç¸®ã•ã‚Œã¾ã™ã€‚ BEASTã¨ã®é–¢ä¿‚ CRIMEã¯B
ç ”ç©¶è€…ãŒæ–°ãŸãªTLSï¼SSLã®è„†å¼±æ€§æ”»æ’ƒãƒ„ール発表ã¸ã€HTTPSセッションを乗ã£å–ã‚Šå¯èƒ½
新攻撃ツールã®ã€ŒCRIMEã€ã¯ã€åœ§ç¸®ãƒ—ãƒãƒˆã‚³ãƒ«ã€ŒSPDYã€ã®å®Ÿè£…ã«é–¢ã™ã‚‹è„†å¼±æ€§ã‚’çªãã€SSLã§æš—å·åŒ–ã•ã‚ŒãŸHTTPSセッションを乗ã£å–ã‚‹ã“ã¨ãŒã§ãã¦ã—ã¾ã†ã¨ã„ã†ã€‚ アルゼンãƒãƒ³ã§9月19æ—¥ã‹ã‚‰é–‹ã‹ã‚Œã‚‹ã‚»ã‚ュリティカンファレンス「ekopartyã€ã§ã€2人ã®ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£ç ”ç©¶è€…ãŒTLSï¼SSLを攻撃ã™ã‚‹æ–°ãƒ„ール「CRIMEã€ã®ç™ºè¡¨ã‚’予定ã—ã¦ã„る。米セã‚ュリティ機関ã®SANS Internet Storm CenterãŒãƒ–ãƒã‚°ã§ä¼ãˆãŸã€‚ SANSã®13æ—¥ã®ãƒ–ãƒã‚°ã«ã‚ˆã‚‹ã¨ã€åŒãƒ„ールã¯åœ§ç¸®ãƒ—ãƒãƒˆã‚³ãƒ«ã€ŒSPDYã€ã®å®Ÿè£…ã«é–¢ã™ã‚‹è„†å¼±æ€§ã‚’çªãã€SSLã§æš—å·åŒ–ã•ã‚ŒãŸHTTPSセッションを乗ã£å–ã‚‹ã“ã¨ãŒã§ãã¦ã—ã¾ã†ã€‚ã“ã®æ”»æ’ƒã¯ã€Webサイトã¨Webブラウザã®ä¸¡æ–¹ãŒSPDYをサãƒãƒ¼ãƒˆã—ã¦ã„ã‚‹å ´åˆã«ã®ã¿é€šç”¨ã™ã‚‹ã‚ˆã†ã ã¨ã—ã¦ã„る。 SPDYをサãƒãƒ¼ãƒˆã—ã¦ã„ã‚‹ã®ã¯ã€ä¸»è¦ãƒ–ラウザã§ã¯Mozillaã®Firefoxã¨Go
1
ランã‚ング
ランã‚ング
ランã‚ング
リリースã€éšœå®³æƒ…å ±ãªã©ã®ã‚µãƒ¼ãƒ“スã®ãŠçŸ¥ã‚‰ã›
最新ã®äººæ°—エントリーã®é…ä¿¡
j次ã®ãƒ–ックマーク
kå‰ã®ãƒ–ックマーク
lã‚ã¨ã§èªã‚€
eコメント一覧を開ã
oページを開ã
779413 - (CVE-2012-3977) SPDY compression infoleak (CRIME)
Old Version of Google Chrome 20.0.1132.47 Download - OldApps.com for Mac
{{#tags}}- {{label}}
{{/tags}}