CRIME (Compression Ratio Info-leak Made Easy) is asecurity vulnerability inHTTPS andSPDY protocols that utilize compression, which can leak the content of secretweb cookies.[1] When used to recover the content of secretauthentication cookies, it allows an attacker to performsession hijacking on an authenticated web session, allowing the launching of further attacks. CRIME was assignedCVE-2012-4929.[2]
The vulnerability exploited is a combination ofchosen plaintext attack and inadvertentinformation leakage through data compression, similar to that described in 2002 by the cryptographerJohn Kelsey.[3] It relies on the attacker being able to observe the size of theciphertext sent by thebrowser while at the same time inducing the browser to make multiple carefully crafted web connections to the target site. The attacker then observes the change in size of the compressed request payload, which contains both the secret cookie that is sent by the browser only to the target site, and variable content created by the attacker, as the variable content is altered. When the size of the compressed content is reduced, it can be inferred that it is probable that some part of the injected content matches some part of the source, which includes the secret content that the attacker desires to discover.Divide and conquer techniques can then be used to home in on the true secret content in a relatively small number of probe attempts that is a small multiple of the number of secret bytes to be recovered.[1][4]
The CRIME exploit was hypothesized by Adam Langley,[5] and first demonstrated by the security researchers Juliano Rizzo and Thai Duong, who also created theBEAST exploit.[6] The exploit was due to be revealed in full at the 2012ekoparty security conference.[7] Rizzo and Duong presented CRIME as a general attack that works effectively against a large number of protocols, including but not limited to SPDY (which always compresses request headers), TLS (which may compress records) and HTTP (which may compress responses).[2]
CRIME can be defeated by preventing the use of compression, either at the client end, by the browser disabling the compression of SPDY requests, or by the website preventing the use of data compression on such transactions using the protocol negotiation features of the TLS protocol. As detailed inThe Transport Layer Security (TLS) Protocol Version 1.2,[8] the client sends a list of compression algorithms in its ClientHello message, and the server picks one of them and sends it back in its ServerHello message. The server can only choose a compression method the client has offered, so if the client only offers 'none' (no compression), the data will not be compressed. Similarly, since 'no compression' must be allowed by all TLS clients, a server can always refuse to use compression.[citation needed]
As of September 2012[update], the CRIME exploit against SPDY and TLS-level compression was described as mitigated in the then-latest versions of theChrome andFirefox web browsers.[6] Some websites have applied countermeasures at their end.[9] Thenginx web-server was not vulnerable to CRIME since 1.0.9/1.1.6 (October/November 2011) usingOpenSSL 1.0.0+, and since 1.2.2/1.3.2 (June / July 2012) using all versions of OpenSSL.[10]
Note that as of December 2013 the CRIME exploit against HTTP compression has not been mitigated at all.[citation needed] Rizzo and Duong have warned that this vulnerability might be even more widespread than SPDY and TLS compression combined.[citation needed]
At the August 2013Black Hat conference, researchers Gluck, Harris and Prado announced a variant of the CRIME exploit against HTTP compression calledBREACH (short for Browser Reconnaissance and Exfiltration via Adaptive Compression of Hypertext). It uncovers HTTPS secrets by attacking the inbuilt HTTP data compression used by webservers to reduce network traffic.[11]
{{cite journal}}:Cite journal requires|journal= (help)