Tell me more ×
IT Security Stack Exchange is a question and answer site for IT security professionals. It's 100% free, no registration required.
up vote 0 down vote favorite
1

This thought/question was inspired/triggered by CRIME - How to beat the BEAST successor?

It was posted as a comment but obviously it should have been posted as a question, so here it is again:

The question is, suppose attacker can get into a man-in-the-middle situation between victim PC and security web server. Victim's browser runs a "evil" javascript by attacker. Can the attacker use this to steal victim's secret (like password)?

Wonder if it's possible to make the "evil" javascript send multiple requests of different lengths to reveal the secret.

For example, suppose the password is "123". In order to reveal the secret to the sniffer, the "evil" javascript will

-- craft a request of length 500 bytes, based on the encrypted length, sniffer may guess first digit is 1.

-- creaft a request of length 600, sniffer may guess second digit is 2, and so on.

To improve the odds, evil javascript may wait a little for traffic to clear (i.e. all elements of the pages to finish loading).

This will not depending on compression algorithm used.

Thanks.

share|improve this question
Law #1: "If a bad guy can persuade you to run his program on your computer, it's not your computer anymore." If the attacker can get a victim to run some javascript code of the attacker's choosing, I don't think the passwords are going to be grabbed by trying to crack SSL. – Iszi Sep 14 '12 at 18:00
Welcome to Security SE. What are you asking here qjian? As @Iszi pointed out, if you can get javascript onto the victim machine you can pretty much do whatever you like, so is there something else you are trying to find out about? If you can edit the question accordingly, we can reopen it. – Rory Alsop♦ Sep 14 '12 at 18:16
Wonder if it's possible to make the "evil" javascript send multiple requests of different lengths to reveal the secret. Yes. That would be a loop. – Jeff Ferland♦ Sep 14 '12 at 19:31

closed as not a real question by Rory Alsop♦ Sep 14 '12 at 18:16

It's difficult to tell what is being asked here. This question is ambiguous, vague, incomplete, overly broad, or rhetorical and cannot be reasonably answered in its current form. For help clarifying this question so that it can be reopened, see the FAQ.

Browse other questions tagged or ask your own question.