[theandrewbailey]

While I agree that RC4 should die in a fire, this attack seems impractical to me.

> To successfully decrypt a 16-character cookie with a success probability of 94%, roughly 9x2^27 encryptions of the cookie need to be captured. Since we can make the client transmit 4450 requests per seconds, this amount can be collected in merely 75 hours.

How likely would that amount of network traffic and energy consumption cue the potential victim that something malicious is going on?

[tomvangoethem]

Colleague of the author here.

I guess that 4450 requests/s to one IP, or even spread across multiple IPs, could trigger some alarms if the victim is alert. Unfortunately, I'm not that familiar with IDS/IPS's to answer that with much confidence.

In any case, an attacker has a lot of options. The requests do not need to be made sequentially, so an attacker could basically start and resume his attack whenever he wants, e.g. when the victim is away from keyboard (which he can estimate based on the network traffic someone usually generates). An attacker could also simply slow down the number of requests/s, although this results in a larger number of hours required for a successful attack.

As for energy/CPU consumption, I don't think that'd be a big concern. When the practical attack was performed, the CPU usage went up to around 75%, still allowing one to visit other websites without noticing anything. So unless one would closely monitor the CPU/network usage, I don't think the average victim would notice it.

[theandrewbailey]

> As for energy/CPU consumption, I don't think that'd be a big concern.

What if this attack targeted a phone or laptop? Battery would die faster, device would get warmer, and fans spin up.

[the8472]

If your last line of defense in encryption/network security is noticing that the fan spins up more often then you already lost the game.

Why even bring it up?

[theandrewbailey]

It's not a line of defense. I'm thinking about less computer literate people. Do you know a friend or family member that would call you and say "My laptop's really hot, loud, and slow, but it's not doing anything!" and ask for advice?

[the8472]

Do you really think they're the kind of people who'll be targeted by this attack instead of some refined version in the future?

Do you really think this scenario is realistic and worthy of consideration at all?

[therusher]

Honestly, the vast majority of people will not notice an increase in traffic, no matter how big it is (this is what, a 285kb/s increase in net traffic?).

I think the bigger issue with this exploit is just the fact that so many submissions need to be sent. I don't really see someone sitting there for 75 hours while this takes place without closing the browser/window/tab.

EDIT: If you're already injecting JS, you're probably better off just phishing the user for their credentials. Faster, easier, and will work more often than relying on the user staying active enough to send traffic for the next 75h.

EDIT 2: Not saying this isn't a valid vulnerability, just not one that can be practically executed currently without much simpler alternatives.

[gipsies]

> I don't really see someone sitting there for 75 hours while this takes place without closing the browser/window/tab.

But that's not a problem. If the user closes the browser or tab, the attack can continue at a later point in time. It doesn't need to be collected all at once. As a concrete example, if you leave your computer at work running during the weekend, the attacker has enough time. Or if you leave it running during the night, the attack can be spread out over a few nights. I'm sure there are even more scenarios than just these two examples: there's room for quite some flexibility when performing the attack.

[therusher]

Correct me if I'm wrong here, but:

That's assuming the attacker regains control, so you'd have to visit a malicious page every time the attack needs to be re-initiated. EDIT: I'm dumb, somehow I managed to forget mid conversation that this was assuming MitM and not a compromised site. Disregard this point.

Also, while this method can be used for other, static data, pretty much all of the stuff you would want / have access to through doing this will be time-sensitive. Even a straight 72h most "secure" things such as cookies will be changed, forcing a restart of this process. Extending this even longer just gives a bigger window for the cookie/whatever to timeout.

EDIT: though I guess if the cookie you're trying to crack doesn't expire, then this could be an issue. I still think there are vastly easier methods if you can arbitrarily inject into http pages though.

[t0mas88]

Note that the "malicious page" could also be embedded / injected in another page. Basically any non-https page opened over public WiFi would be enough. And conveniently users on public wifi are also the easiest to sniff, so the group on which breaking encryption makes most sense.

[cesarb]

> That's assuming the attacker regains control, so you'd have to visit a malicious page every time the attack needs to be re-initiated.

Every non-HTTPS page can be considered malicious, if the attacker can do a MITM.

Since the attacker can capture the encrypted traffic, he most probably is in the middle and can do a MITM.

Therefore, if you are under this attack, every non-HTTPS page is malicious.

[X-Istence]

Impractical or not, this is still showing a possible attack.

Let's say the client leaves their computer on at work over a long weekend ...

The collision attacks against MD5 were at first also claimed to be impractical...

[valarauca1]

rc4 has been cryptographically broken before its specification has been public. Its first reference on usenet was a discussion of how to break it. Which OP's attack is fundamentally the same.

It really shouldn't have been considered a proper cryptographic cypher ever.

[yuhong]

Yea, I like to mention how it was considered a trade secret of RSA Security.

[rogerbinns]

This is how these attacks work. Someone comes up with numbers like the above and publish. Others improve on it and the amount of work needed reduces. You can see it happen with hash functions as Valerie Aurora shows (also see the reactions table): http://valerieaurora.org/hash.htm

[dlitz]

Broken link?

[rogerbinns]

Sorry. There should be a trailing 'l' that got dropped when I copy pasted.

[dlitz]

Oops, I thought I'd also tried that correction, but I must have made a typo. :)

[tyho]

How often do you leave a web page open on your computer then leave for a while, I often do. It would probably be prudent that the NSA has ways of doing this with much less effort, perhaps bringing down the number of requests needed to just a few thousand.

[thefreeman]

4450 requests per second seems like it would only be possible in an intranet setting where the requests resolve basically instantly. I believe browsers are restricted to 8 active XHR per domain which makes it seem even less likely you could achieve this kind of throughput on an actual website with any kind of latency at all.

[derefr]

Do you know if the per-domain concurrent request limit is actually a request limit, or just a socket limit? That is, does it still apply if you're making all those requests using one HTTP/2 carrier socket?

[bmm6o]

I believe the HTTP spec talks about requests, though I don't know how this was translated into the HTTP/2 spec.

[billyhoffman]

Attacks against crypto only get better, not worse.