The BEAST Wins Again: Why TLS Keeps Failing to Protect HTTP
summary
Demonstrates three concrete exploits that bypass HTTPS assumptions: a renegotiation-style attack re-enabled by implementation quirks, a truncation exploit that strips HSTS and stores secure cookies without the Secure flag, and a virtual host confusion chain that uses shared TLS session caches and fallback routing to impersonate thousands of sites (Microsoft, Apple, Twitter, PayPal) on real CDNs. Exploits run as man‑in‑the‑middle proofs‑of‑concept (custom MITM/demo code), successfully weaponize cookie forcing, and remain possible on unpatched servers and some clients (curl, wget, certain server configs).
AI-written summary · about
chapters (16)
- 0:00TLS vulnerabilities intro
- 2:11Why TLS matters beyond passwords
- 8:12BEAST and related attacks history
- 13:53Cookie Cutter attack demo
- 23:48Virtual host confusion
- 29:36Cross-protocol redirection
- 33:51User content origin confusion
- 37:41Shared session cache flaws
- 41:53Akamai reverse proxy exploit
- 44:45SPDY connection pooling risks
- 45:30Triple Handshake details
- 48:24Fixing TLS failures
- 49:06HTTPS attack lessons
- 50:31Authenticated routing in cloud
- 51:55TLS API and implementation flaws
- 52:17Future of TLS verification
related talks
53mHansel and Gretel do TLS
01h 01mHTTPS & TLS in 2016: Security practices from the front lines
13mA Positive Security Talk
45mHTTP Desync Attacks: Smashing Into The Cell Next Door
37mHTTPS Is Better than Ever Before. Now Its Your Turn.
46mBreaking Out HSTS (and HPKP) On Firefox, IE/Edge and (Possibly) Chrome
46mBypassing HTTP Strict Transport Security
36mHTTPS Is Not Enough