- Source: BREACH
- Source: Breach
BREACH (a backronym: Browser Reconnaissance and Exfiltration via Adaptive Compression of Hypertext) is a security vulnerability against HTTPS when using HTTP compression. BREACH is built based on the CRIME security exploit. BREACH was announced at the August 2013 Black Hat conference by security researchers Angelo Prado, Neal Harris and Yoel Gluck. The idea had been discussed in community before the announcement.
Details
While the CRIME attack was presented as a general attack that could work effectively against a large number of protocols, only exploits against SPDY request compression and TLS compression were demonstrated and largely mitigated in browsers and servers. The CRIME exploits against HTTP compression has not been mitigated at all, even though the authors of CRIME have warned that this vulnerability might be even more widespread than SPDY and TLS compression combined.
BREACH is an instance of the CRIME attack against HTTP compression—the use of gzip or DEFLATE data compression algorithms via the content-encoding option within HTTP by many web browsers and servers. Given this compression oracle, the rest of the BREACH attack follows the same general lines as the CRIME exploit, by performing an initial blind brute-force search to guess a few bytes, followed by divide-and-conquer search to expand a correct guess to an arbitrarily large amount of content.
Mitigation
BREACH exploits the compression in the underlying HTTP protocol. Therefore, turning off TLS compression makes no difference to BREACH, which can still perform a chosen-plaintext attack against the HTTP payload.
As a result, clients and servers are either forced to disable HTTP compression completely (thus reducing performance), or to adopt workarounds to try to foil BREACH in individual attack scenarios, such as using cross-site request forgery (CSRF) protection.
Another suggested approach is to disable HTTP compression whenever the referrer header indicates a cross-site request, or when the header is not present. This approach allows effective mitigation of the attack without losing functionality, only incurring a performance penalty on affected requests.
Another approach is to add padding at the TLS, HTTP header, or payload level. Around 2013–2014, there was an IETF draft proposal for a TLS extension for length-hiding padding that, in theory, could be used as a mitigation against this attack. It allows the actual length of the TLS payload to be disguised by the insertion of padding to round it up to a fixed set of lengths, or to randomize the external length, thereby decreasing the likelihood of detecting small changes in compression ratio that is the basis for the BREACH attack. However, this draft has since expired without further action.
A very effective mitigation is HTB (Heal-the-BREACH) that adds random-sized padding to compressed data, providing some variance in the size of the output contents. This randomness delays BREACH from guessing the correct characters in the secret token by a factor of 500 (10-byte max) to 500,000 (100-byte max). HTB protects all websites and pages in the server with minimal CPU usage and minimal bandwidth increase.
References
External links
Official BREACH website
Tool that runs the BREACH attack demonstrated at BlackHat 2013
HEIST, a related compression-based attack on the body of the response demonstrated at BlackHat 2016
Breach, Breached, or The Breach may refer to:
Places
Breach, Kent, United Kingdom
Breach, West Sussex, United Kingdom
The Breach, Great South Bay in the State of New York
People
Breach (DJ), an Electronic/House music act
Miroslava Breach (1963–2017), Mexican journalist
Arts, entertainment, and media
= Films
=Breach (2007 film), a film directed by Billy Ray starring Chris Cooper and Ryan Phillippe
Breach (2020 film), a 2020 film starring Bruce Willis
The Breach (film), a 1970 French film by Claude Chabrol
= Games
=Breach (1987 video game), a 1987 action game by Omnitrend Software
Breach (2011 video game), a defunct 2011 first-person shooter by Atomic Games
Breach (2018 video game), a cancelled 2018 action RPG by QC Games
Breached (video game), a 2016 action puzzle by Drama Drifters
Breach, an agent from the 2020 first-person shooter Valorant
= Journalism
=The Breach (website), a Canadian news website launched in 2021
= Music
=Groups
Breach (band), a Swedish post-hardcore band
Breached, a Canadian rock band
Albums
Breach (Lewis Capaldi EP), 2018
Breach (Shivaree EP), 2004
Breach (The Wallflowers album), 2000
Songs
"Breach (Walk Alone)", 2018, by Martin Garrix and Blinders
"Breach", a song by Erra from the 2018 album Neon
= Television
="Breach", a 2010 episode of the first season of NCIS: Los Angeles
"The Breach" (Star Trek: Enterprise), a 2003 episode of the second season of Star Trek: Enterprise
= Other arts, entertainment, and media
=Breach (character), a superhero from DC Comics
Warp core breach, a catastrophic event aboard a starship in the Star Trek fictional universe
Law
Breach of confidence, a common law tort that protects private information that is conveyed in confidence
Breach of contract, a situation in which a binding agreement is not honored by one or more of the parties to the contract
Breach of duty of care, common law negligence
Breach of promise, a former common law tort
Breach of the peace, a legal term used in constitutional law in English-speaking countries
Efficient breach, a breach of contract that the breaching party considers desirable
Fundamental breach, a breach so fundamental that it permits the aggrieved party to terminate performance of the contract
Science, social science, and technology
BREACH, a security exploit against the HTTPS protocol
Breach, whale surfacing behaviour (a whale's leap out of the water)
Breaching experiment, a social experiment that tests people's reactions to the violation of accepted social norms
Data breach, the release of secure or private information to an untrusted environment
Security breach, unauthorized access to a computer
Other uses
Door breaching, a process to force open closed and/or locked doors
See also
Breech (disambiguation)
Tortious interference, a tort involving inducing persons to breach a contract
Kata Kunci Pencarian:
- Rumah Sakit Breach Candy
- Breach (film 2020)
- Breach (film)
- Canva
- Gibran Rakabuming Raka
- Pemilihan umum Presiden Indonesia 2024
- Yayasan SCP
- Minuman keras
- BreachForums
- Five Nights at Freddy's: Security Breach
- BREACH
- Breach
- Into the Breach
- Data breach
- Door breaching
- Breach (character)
- Breach of contract
- List of data breaches
- Breach of confidence
- Jules Breach
No More Posts Available.
No more pages to load.
