Hacker News Reader

Comment by dekz | Hacker News Reader

TLS(SSL) broken != Browser Exploit Against SSL/TLS (BEAST). Please change the headline.

". We present one application the attack: BEAST. BEAST focuses on SSL implementations on browsers which is HTTPS. BEAST works for most major browsers and websites."

The researchers said that the browser-based attack is just one variant. They said they also could implement a similar attack against other services that use SSL, such as instant-messaging clients or VPNs."

Please read the article before flaming it.

Please read the article linked to by the original post, not the article linked to by another commenter. The article on The Register which was linked to says nothing about VPNs or instant messaging clients.

Did you read page 2 of The Register article?

Duong and Rizzo said the underlying vulnerability BEAST exploits is present in virtually all applications that use TLS 1.0, making it possible to apply the technique to monitor private communications sent through many instant messenger and Virtual Private Networking programs.

I didn't even see there was a page 2 on the Register article, so mea culpa on that (though the parent's quote was indeed not from that page, but from one another commenter linked to).

They can do similar by sharing a SSL(only on CBC?) socket and piping known plain-text into it. This doesn't mean TLS itself is broken.

Well TLS is supposed to protect you from that sort of thing. They fixed it in TLS 1.1 and 1.2.

It claims to be a practical working attack, and it says they haven't found a practical solution. The title accurately reflects how I interpret the gist of the situation.

This attack could only be potentially practical against web browsers, not other applications implementing TLS.

They claim to also be able to perform the attack on other applications using TLS (such as VPNs), not just web browsers.

Quite possibly, but this is about BEAST and the ability of loading malicious Javascript. Performing the feat of code injection on a non-browser application is something completely different. If something is injecting code into your native application or throwing known plaintext into your socket streams then you've already been compromised.

You don't need to inject code, you need to inject traffic. Injecting code into client is only one way to do that. For example in many VPN deployments you can inject traffic into secure channel directly.

Reply on news.ycombinator.com