Top 10 winner
Angelo Prado, Neal Harris, Yoel Gluck -- BREACH
BREACH Compression Attack Steals HTTPS Secrets in Under 30 Seconds
Report on BREACH, presented at Black Hat USA 2013 by Angelo Prado, Neal Harris and Yoel Gluck. Where CRIME attacked TLS compression, BREACH attacks HTTP-level gzip: the attacker reflects guessed characters into a response that also holds a CSRF token and watches the compressed length shrink on a correct guess. The demo recovered a 30-character token in under 30 seconds.
Record
- Document
- BREACH Compression Attack Steals HTTPS Secrets in Under 30 Seconds
- Researcher
- Michael Mimoso
- Published by
- Threatpost | The first stop for security news
- Date
- Topic
- Crypto
In the archive
Tags
This page is the archive's own catalogue record. The research is the work of Michael Mimoso, first published at the original source. Preserved copies are kept so the citation survives its host; this one was last captured on .