Rizzo and Duong will announce how CRIME (BEAST's successor) works in 2 weeks - we think we know already at security.stackexchange.com. Check out our blog post.
security.blogoverflow.com/2012/09/how-can-you...Posted Sep 10, 2012, 8:45 PM UTC
3712
security.blogoverflow.com
It looks like this assumption is correct – Chromium disabled TLS compression on August 3rd: https://chromiumcodereview.appspot.com/10825183
Also Firefox, Chrome and Safari send ClientHello without advertising compression support – they silently removed it one month ago
Looks like Thomas is spot on with this one!
8
Bug 139744 referenced in this CR returns a permission denied error - typically a tell-tale sign of a security-related issue.
Sounds like compression is very likely the issue CRIME exploits.
2
Nice find, that looks like some very good circumstantial evidence for this.
1
This is a great find, the deal is sealed.
1
Wow, that's awesome, really clever. I'd love to see (or write if I had the time) some PoC code for this.
3
I've got the PoC for the compression leak http://blog.kotowicz.net/2012/09/if-its-crime-than-im-guilty.html - it's a real deal, at least the zlib compression leak. We're just missing the whole SSL setup on top to see if and how it's possible to detect it in ciphertext.
7
Nice! Your blog is great btw, been following it for a while.
1
In theory it works, but in practice? How much time from speculation to working code?
1
PoC is out to prove the method. Framework for delivery will be released at Ekoparty in less than two weeks.
2
Does anyone have any data on which server technologies support compression (and which support it by default)? My IIS 7.5 servers send a reset packet if I try to connect using deflate compression whereas my JBoss 4.3 servers just ignore client compression flags and always use null compression.
1
PoC code from that thread. Fun stuff.
1
It would be rather funny if this poster was incorrect and actually stumbled upon a completely new vulnerability, on top of whatever one CRIME utilizies.