Decrypting SSL with BEAST

synthead · 2012-03-09 03:11:01

I found this to be very interesting!

First, watch this video and read the blog post:
http://vnhacker.blogspot.com/2011/09/beast.html

Then check out a Javascript mockup of how the BEAST attack works:
http://erlend.oftedal.no/blog/beast/

Now, check if your site (or others'!) is vulnerable to the attack:
https://www.ssllabs.com/ssldb/analyze.html

And read about how to prevent it:
https://community.qualys.com/blogs/secu … ack-on-tls

Then, take a look at what /etc/httpd/conf/extra/httpd-ssl.conf has to say about RC4:

#   Speed-optimized SSL Cipher configuration:
#   If speed is your main concern (on busy HTTPS servers e.g.),
#   you might want to force clients to specific, performance
#   optimized ciphers. In this case, prepend those ciphers
#   to the SSLCipherSuite list, and enable SSLHonorCipherOrder.
#   Caveat: by giving precedence to RC4-SHA and AES128-SHA
#   (as in the example below), most connections will no longer
#   have perfect forward secrecy - if the server's key is
#   compromised, captures of past or future traffic must be
#   considered compromised, too.
#SSLCipherSuite RC4-SHA:AES128-SHA:HIGH:MEDIUM:!aNULL:!MD5
#SSLHonorCipherOrder on

Yikes! If you were a MITM, you could simply inject some hidden javascript as part of a regular HTTP page, maybe even google.com, and listen all day for cookies. Baaad, bad, bad, bad! Most sources online comment that there are more malicious ways to steal information that are more effective and don't involve decrypting anything, which is true, but SSL of all things!

Please post your thoughts!

lifeafter2am · 2012-03-09 03:19:04

No scarier to me then using SSLStrip ... as far as I am concerned SSL has been broken since Moxie released the tool back in 2009. One of the main reasons all company traffic has to be piped through VPNs now ... SSL isn't good enough anymore.

Arch Linux

#1 2012-03-09 03:11:01

Decrypting SSL with BEAST

#2 2012-03-09 03:19:04

Re: Decrypting SSL with BEAST

Board footer