2

I've been researching BREACH, and while I can understand how it might work if you have access to the the browser (to send crafted requests) and the wire (to capture compressed response length), I haven't seen a way to do this without access to the wire, aside from a fragile timing attack on response time. You can get Content-length with this code, but it only works if the site enabled CORS and isn't used a chunked Content-length.

var req = new XMLHttpRequest();
req.open('GET', document.location, false);
req.send(null);
req.getAllResponseHeaders().toLowerCase();

There's also an iframe approach, but I'm not aware of a way to get the Content-length for an iframe, and again, this fails if it's chunked.

Am I missing something? I there a technique I haven't covered for getting the Content-length? It doesn't seem to be a viable attack without both access to the browser and access to either that, or to the wire.

1

The BREACH attack is a Side-Channel attack. You need some way to access the side channel.

On page 13 of the presentation, you can see what BREACH needs the attacker to set up:

  1. A web server serving the site the browser visits.

  2. A callback where the javascript on the victim's browser notifies the attacker that the request completed, giving time information about when the packets with the currently tried string went through.

  3. A MITM for monitoring the length of the sent packets.

So, in other words, you need access to the wire.

  • But not just the side channel; you also need access to the browser? This might just mean a link the user opened, or maybe an injected iframe in an HTTP request (that's quite doable if you have access to the wire). – David Ehrmann Sep 4 '14 at 22:32
  • lots of side channel attacks base on plaintext-injection-like methods. – user10008 Sep 4 '14 at 22:39
  • Isn't BREACH the least of your worries if there is a MITM? I mean, it seems like the requirements in order for this to be effective would leave to you open to much more sinister attacks. What am I missing? – k1DBLITZ Sep 5 '14 at 14:56
  • In the context of the paper, MITM just means there is somebody that can read your encrypted traffic. – user10008 Sep 5 '14 at 16:37

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.