Cryptography is a hot topic in cybersecurity over the last couple of years. A lot of misuses and critical vulnerabilities have beed discovered (Heartbleed, POODLE, BEST, CRIME) that are related to weak ciphers and outdated software. Those who were up to date with the patching of their environments might think they’re safe. We would not be so sure about that!

You might say: ‘But my page is served over HTTPS!’

Just because websites have an SSL certificate and all the website traffic goes through HTTPS protocol doesn’t mean that these websites are secure. These days it’s not only the well known vulnerabilities that are dangerous (and yes, these Poodle, Heathbleed or weak Ciphers are still present in many large networks as we observed), but there are attacks that can bypass even the strongest 4096 bit encryption and updated SSL libraries.

One of those attacks is the BREACH attack.

What is a BREACH attack?

The BREACH attack was discussed a couple of years ago at the BlackHat 2013 and ever since then, it has received a couple of upgrades with a set of tools that help to perform these attacks fairly easy. Those tools can be used by both sides of the force so don’t think that the Penetration Testers (White Hats) are the only ones that use it. This attack is an oracle attack type which means that by having the ability to perform different queries to the system and observing the answers, a person might be able to disclose some information that is confidential (although the answers to those questions themselves are irrelevant). To be able to do that the attacker analyses the size of HTTP response to different queries and by knowing the pattern of searched secret (e.g. Cookie) he may by able to find it in just a couple of minutes.

What to do? How to avoid such attacks?

One thing we have to make clear is that not every HTTPS website is vulnerable. There are some specific conditions that have to be met in order for the BREACH attack to be possible. However, mitigating the risks of being hit by a BREACH attack is certainly not easy and it takes time. There are a number of ways to mitigate the risk of an attack and they require expertise and specific knowledge. If you want to ensure that your website is not susceptible to a BREACH attack contact our security experts today!