Information Security Stack Exchange is a question and answer site for information security professionals. It only takes a minute to sign up.
Sign up to join this community
It is my understanding that BEAST only works on TLS1.0 and I got confused when I saw a demonstration of BEAST attack on paypal.com, locally: https://www.youtube.com/watch?v=BTqAIDVUvrU
Paypal uses TLS1.2, so I'm not sure how the attack could reveal the message, or cookie in this case?
Paypal supports TLS 1.0, 1.1, and 1.2. If your browser advertises that it would like to use TLS 1.2, then that is indeed the TLS version that Paypal will choose to connect with. If, however, your browser suggests to Paypal's servers that the highest TLS version it supports is 1.0, then Paypal will happily connect using that protocol version as well. I imagine that this is exactly what whoever was demoing BEAST did. Set their browser up so that it would only use v1.0, and not 1.1 or 1.2.
