| Two researchers have uncovered a new vulnerability in the Transport Layer Security (TLS) and Datagram TLS (DTLS) protocols that allow attackers to recover plaintext from a TLS/DTLS connection when CBC-mode encryption is used.
The attack would allow hackers to circumvent the protection the protocols are supposed to provide. This is not the first time researchers have poked holes in TLS; in 2011, researchers introduced BEAST, a tool that attacked TLS and the SSL (secure sockets layer) protocols. In this case, the Kenny Paterson - a professor at Royal Holloway, University of London – and PhD student Nadhem AlFardan tested their attack against OpenSSL and GnuTLS and discovered that either a full or partial plaintext recovery attack was possible.
"The attacks arise from a flaw in the TLS specification rather than as a bug in specific implementations," the researchers stated in a web post. "We have carried out experiments to demonstrate the feasibility of the attacks against the OpenSSL and GnuTLS implementations of TLS, and we have studied the source code of other implementations to determine whether they are likely to be vulnerable. There are effective countermeasures against our attacks and we have worked with a number of TLS and DTLS software developers to prepare patches and security advisories." Read More .. |
JB via www.securityweek.com, 3 months, 2 weeks ago