HEIST: HTTP Encrypted Information can be Stolen Through TCP-Windows

on YouTube ↗50m

" summary

HEIST presents browser-based techniques that exploit interactions between HTTP, TLS/SSL, and TCP to create a side channel revealing the exact size of cross-origin responses by observing how responses are sent at the TCP layer. Using that plaintext-length leak, the techniques enable purely in-browser compression attacks (e.g., CRIME/BREACH style) and other data-exfiltration against web services (including HTTP/2), without needing to sniff or modify network traffic.

AI-written summary · about

" chapters (15)

1. 0:00Introduction and logistics
2. 0:43Technical background
3. 1:56Same origin policy overview
4. 5:10Compression based attacks
5. 9:49SSL, TLS, and TCP details
6. 12:54Heist attack mechanisms
7. 18:46Determining response size
8. 21:10TCP window exploitation
9. 24:26Http2 exploitation
10. 29:42Attack demonstration
11. 32:48Live attack demonstration
12. 36:29Attack impact and scope
13. 37:56Countermeasures and defenses
14. 39:47Conclusion
15. 41:20Questions and answers

" related talks

• 49mSecurity and Insecurity of HTTP HeadersDirk Wetter · OWASP AppSec Research (AppSecEU) 2015
• 45mHTTP Desync Attacks: Smashing Into The Cell Next DoorJames Kettle · OWASP Global AppSec Amsterdam 2019
• 50mHTTP Desync Attacks: Smashing into the Cell Next DoorJames Kettle · Black Hat USA 2019
• 53mThe BEAST Wins Again: Why TLS Keeps Failing to Protect HTTPAntoine Delignat-Lavaud · Black Hat USA 2014
• 21mOff-Path TCP Exploit: How Wireless Routers Can Jeopardize Your SecretsWeiteng Chen · USENIX Security '18
• 53mPractical New Developments in The Breach AttackDimitris Karakostas, Dionysios Zindros · Black Hat Asia 2016
• 27mRequest and Conquer: Exposing Cross-Origin Resource SizeTom Van Goethem, Mathy Vanhoef, Frank Piessens, Wouter Joosen · USENIX Security '16
• 19mWhat's happening in TLS (transport layer security)?Mark Nottingham · Web Directions Code 2014