Secure web browsing cracked by BEAST !!!

[INDRANIL]

A pair of researchers have unveiled a serious new attack on web browser security.

The researchers used this week's Ekoparty security conference in Buenos Aires to unveil a new tool that attacks TLS and SSL, the cryptographic protocols used to establish secure web connections. The ability to crack encrypted web traffic removes the safety net that protects you when you're doing sensitive online tasks like banking or using credit cards. The tool, known as BEAST (Browser Exploit Against SSL/TLS), compromises TLS by exploiting a vulnerability that has been known about for years but which has been treated as a theoretical problem until now.

However, although researchers Thai Duong and Juliano Rizzo have significantly raised the stakes it's probably too early to start hoarding tins of beans and donning our tin foil hats.

Right now the attack can take up to half an hour to execute. Although the researchers have hinted that this can be significantly reduced the fact is that if you have the malicious nature, time and access required to execute this attack then there are probably easier ways to exercise your criminal ambitions.

The danger of BEASTly attacks against TLS has moved a little closer but we probably have enough time to react before it becomes practical.

A good start would be for browser and server vendors to pull their collective fingers out and start supporting versions 1.1 and 1.2 of TLS. Both of them have specific defences against this kind of attack but unfortunately support for them is poor.

Duong and Rizzo tipped off the major browser vendors about their findings months ago but so far the only response appears to have come from the folks at Chrome. A fix for the attack is currently under test in the development version of their browser.

Scary ehh ?? . Ok here goes a good article about the attack methodology . Have a nice time .

More & Source .

[Bearcat]

Thanks for the heads up Indra. Soemthing else to keep an eye out for, eh?

[Bluedot]

I always knew the Beast was unbeatable, however powerful the antivirus engines may be. This in fact proves something else. A pen in the hands of a serial killer is deadlier than a gun in the hands of a normal guy.

[safeguy]

A pen in the hands of a serial killer is deadlier than a gun in the hands of a normal guy.

I'm sorry but I consider the latter deadlier.