TLS Attacks: BEAST, POODLE & Downgrade

TLS attacks fall into: protocol-level (BEAST, POODLE, DROWN), cryptographic (RC4 biases, Lucky13), and implementation (Heartbleed, BERserk). TLS 1.3 eliminates the protocol-level attacks by removing vulnerable algorithms.

Browser Exploit Against SSL/TLS: exploits CBC mode in TLS 1.0 where the IV for each record is the last ciphertext block of the previous record (predictable IV). Attacker injects chosen plaintext blocks to recover session cookies via a chosen-boundary attack.

Fix: use TLS 1.1+ (random IVs per record), or use RC4 instead of CBC (bad trade). Modern fix: TLS 1.3 uses only AEAD — no CBC. Browsers mitigated BEAST via 1/n-1 record splitting before TLS 1.1 was widespread.

Padding Oracle On Downgraded Legacy Encryption: attacks SSL 3.0 CBC mode. SSL 3.0 padding is not integrity-protected, enabling a padding oracle. Attacker forces a downgrade to SSL 3.0 via connection failures, then decrypts 1 byte per ~256 requests.

Disable SSL 3.0 entirely (TLS_FALLBACK_SCSV extension signals intentional downgrade to prevent malicious downgrades). POODLE also applies to TLS implementations that improperly ignore CBC padding structure.

Decrypting RSA with Obsolete and Weakened eNcryption: if a server shares an RSA key with any server that accepts SSLv2, Bleichenbacher-style padding oracle attacks against SSLv2 can decrypt TLS 1.2 sessions. Affected 33% of HTTPS servers.

An active attacker can drop or corrupt packets to force both endpoints to negotiate a weaker protocol or cipher. TLS_FALLBACK_SCSV (RFC 7507) signals the maximum protocol version the client supports, preventing malicious downgrade.

Timing side-channel in CBC-mode TLS: MAC verification time varies by padding length. Attacker measures response time to distinguish valid from invalid padding, enabling a padding oracle across the network. Requires ~2^23 oracle queries per byte.

RC4 produces biased bytes — byte 2 is biased toward 0. For TLS sessions where headers repeat at fixed offsets (cookies), statistical recovery of plaintext is possible with ~2^24 samples. RC4 is banned in TLS since RFC 7465 (2015).

Not a TLS protocol flaw but an OpenSSL implementation bug: the Heartbeat extension read up to 64 KB beyond the intended buffer, leaking private keys, session tokens, and passwords from server memory. 17% of secure web servers were vulnerable.

TLS 1.3 removes CBC ciphers, RC4, SSL 2.0/3.0, static RSA key exchange, and compression. Mandatory ECDHE ensures forward secrecy. The narrowed cipher list eliminates the surface area for all known protocol-level attacks.

Which attack exploited predictable IVs in TLS 1.0 CBC mode?

You have studied BEAST, POODLE, DROWN, Lucky13, and RC4 bias attacks. TLS 1.3 eliminates the conditions that made these possible. Next: JWT structure, signing, and vulnerabilities.