HEIST: HTTP Encrypted Information can be Stolen through TCP-windows

← back to the blog

HEIST: HTTP Encrypted Information can be Stolen through TCP-windows
25th October 2016

Over the last few years, a worryingly number of attacks against SSL/TLS and other secure channels have been discovered. Fortunately, at least from a defenders perspective, these attacks require an adversary capable of observing or manipulating network traffic. This prevented a wide and easy exploitation of these vulnerabilities. In contrast, we introduce HEIST, a set of techniques that allows us to carry out attacks against SSL/TLS purely in the browser. More generally, and surprisingly, with HEIST it becomes possible to exploit certain flaws in network protocols without having to sniff actual traffic.

HEIST abuses weaknesses and subtleties in the browser, and the underlying HTTP, SSL/TLS, and TCP layers. In particular, we discover a side-channel attack that leaks the exact size of any cross-origin response. This side-channel abuses the way responses are sent at the TCP level. Combined with the fact that SSL/TLS lacks length-hiding capabilities, HEIST can directly infer the length of the plaintext message. Concretely, this means that compressionbased attacks such as CRIME and BREACH can now be performed purely in the browser, by any malicious website or script, without requiring a man-in-the-middle position. Moreover, we also show that our length-exposing attacks can be used to obtain sensitive information from unwitting victims by abusing services on popular websites.

Finally, we explore the reach and feasibility of exploiting HEIST. We show that attacks can be performed on virtually every web service, even when HTTP/2 is used. In fact, HTTP/2 allows for more damaging attack techniques, further increasing the impact of HEIST. In short, HEIST is a set of novel attack techniques that brings network-level attacks to the browser, posing an imminent threat to our online security and privacy,

To read the entire brief: https://www.blackhat.com/docs/us-16/materials/us-16-VanGoethem-HEIST-HTTP-Encrypted-Information-Can-Be-Stolen-Through-TCP-Windows-wp.pdf

7 World Trade Center
250 Greenwich St
New York, NY 10007
466 Southern Blvd
Chatham Township, NJ 07928
3 Shalem St.
Ramat Gan, Israel
Teerth Technospace
S. No. 103
Mumbai Banglore Highway
Baner, Pune
Maharashtra 411045, India
Phone Numbers
+1 212 520 2557
+1 844 33-RELID
+1 844 337-3543
+972 (72) 2433000
+972 (72) 2733379 (f)
Hong Kong:
+852 6417 4790
+91 20 6725 3900