Transport Layer Security (TLS) is a security protocol that provides authentication, privacy, and data integrity. It is most widely-deployed and used for web browsers and other applications.
TLS is the successor protocol to SSL. These cryptographic protocols have had their own share of flaws like any other technology.
So, it is important to understand the flaws in order to secure your servers. Some of the SSL/TLS vulnerabilities are:
POODLE ATTACK
In the Padding Oracle On Downgraded Legacy Encryption (POODLE) attack, an active MITM attacker can force a browser to downgrade the session to SSLv3, which can then be exploited. The vulnerability affects TLS implementations that don't properly check the structure of the padding used in TLS packets.
FREAK ATTACK
Factoring Attack on RSA-EXPORT Keys (FREAK) is an SSL/TLS vulnerability that can allow an attacker to decrypt secure communications between vulnerable clients and servers.
SWEET32: BIRTHDAY ATTACK
The SWEET32 attack exploits a collision attack in SSL/TLS protocol cipher suites. When CBC mode of encryption is used, these cipher suites uses 64-bit block ciphers to extract plain text of the encrypted data.
BLEICHENBACHER WITH THE ROBOT ATTACK
Return of Bleichenbacher’s Oracle Threat vulnerability, also known as ROBOT, allows an attacker to gain the RSA key necessary to decrypt TLS traffic under some specific conditions. An attacker can exploit this vulnerability by sending crafted TLS messages to the device, which would act as an oracle and allow the attacker to carry out a chosen-ciphertext attack.
BEAST ATTACK
The BEAST attack exploits a weakness in SSL/TLS cipher-block chaining (CBC). It allows a man-in-the-middle attacker to recover certain session information.
CRIME ATTACK
CRIME, “Compression Ratio Info-leak Made Easy “, is a security exploit against secret web cookies over connections using the HTTPS and SPDY protocols that also use data compression.
BREACH ATTACK
BREACH, “Browser Reconnaissance and Exfiltration via Adaptive Compression of Hypertext”, targets information compressed in HTTP responses through HTTP compression.
More detailed version along with how you can avoid these vulnerabilities is published at : https://beaglesecurity.com/blog/blogs/2020/07/06/Importance-of-TLS-1-3-SSL-and-TLS-Vulnerabilities.html
Top comments (0)