HTTP!
Encrypted!
Information can be!
Stolen through!
TCP-windows
by!
Mathy Vanhoef & Tom Van Goethem

Agenda•Technical background!
•Same-Origin Policy!

•Compression-based attacks!

•SSL/TLS & TCP!

•Nitty gritty HEIST details!

•Demo!

•Countermeasures
HEIST

2

Same-Origin Policy
GET /vault

Mr. Sniffles

https://bunnehbank.com

HEIST

3

Same-Origin Policy
GET /vault

Mr. Sniffles

https://bunnehbank.com

HEIST3the World Wide Web

https://bunnehbank.com

Mr. Sniffles

HEIST4the World Wide Web

https://bunnehbank.com

Mr. Sniffles

HEIST4the World Wide Web

GET /vault

https://bunnehbank.com

Mr. Sniffles

HEIST4the World Wide Web

GET /vault

https://bunnehbank.com

Mr. Sniffles

HEIST4the World Wide Web

GET /vault

https://bunnehbank.com

Mr. Sniffles

HEIST4the World Wide Web

GET /vault

https://bunnehbank.com

Mr. Sniffles

HEIST4the World Wide Web

GET /vault

https://bunnehbank.com

Mr. Sniffles

HEIST5the World Wide Web

GET /vault

https://bunnehbank.com

Mr. Sniffles

HEIST6

Agenda•Technical background!
•Same-Origin Policy!

•

Compression-based attacks!

•SSL/TLS & TCP!

•Nitty gritty HEIST details!

•Demo!

•Countermeasures
HEIST

7

/vault
Uncompressed

Compressed

You requested:/vault

You requested:/vaultvault_secret=carrots4life→ 51 bytes_secret=carrots4life→ 47 bytes
HEIST

8

/vault?secret=a/vault?secret=c

You requested:/vault?secret=a_You requested:/vault?secret=c

carrots4life_→ 50 bytes

arrots4life→ 49 bytes
HEIST

9

/vault?secret=a/vault?secret=c

You requested:
You requested:/vault?secret=a49 bytes < 50 bytes → 'c' is a /vault?secret=ccorrect guess_carrots4life_→ 50 bytes

arrots4life→ 49 bytes
HEIST

10

/vault?secret=ca/vault?secret=cb

You requested:/vault?secret=ca_

You requested:/vault?secret=cb

rrots4life_→ 49 bytes

arrots4life→ 50 bytes
HEIST

11

/vault?secret=ca/vault?secret=cb

You requested:
You requested:/vault?secret=ca
49 bytes < 50 bytes → 'ca' is a/vault?secret=cb
correct guess_rrots4life_→ 49 bytes

arrots4life→ 50 bytes
HEIST12

Compression-based Attacks•

Compression and Information Leakage of Plaintext [FSE'02]!
••

CRIME [ekoparty'12]!
••

Chosen plaintext + compression = plaintext leakage!

Exploits SSL compression!

BREACH [Black Hat USA'13]!
•Exploits HTTP compression
HEIST

13

Agenda•Technical background!
•Same-Origin Policy!

•Compression-based attacks!

•SSL/TLS & TCP!

•Nitty gritty HEIST details!

•Demo!

•Countermeasures
HEIST14

GET /vault

TCP handshake
SYN

SYN, ACKACK

SSL handshake
Client Hello
Server Hello
Pre-Master SecretHEIST

15

GET /vaultencrypt(GET /vault HTTP/1.1
Cookie: user=mr.sniffles!
Host: bunnehbank.com!
....
)
1 TCP data packet

HEIST16

encrypt() = 29 TCP data packets

HEIST

17

encrypt() = 29 TCP data packets
TCP packet 1
TCP packet 2...
TCP packet 10

HEIST

initcwnd=
10

18

encrypt() = 29 TCP data packets
TCP packet 1
TCP packet 2...
TCP packet 10

initcwnd=
1010 ACKs

HEIST

18

encrypt() = 29 TCP data packets
TCP packet 1
TCP packet 2...
TCP packet 10initcwnd=
1010 ACKs
cwnd = 20

HEIST18

encrypt() = 29 TCP data packets
TCP packet 1
TCP packet 2...
TCP packet 10

initcwnd=1010 ACKs
TCP packet 11...
TCP packet 29

HEISTcwnd = 2018

HEIST•

A set of techniques that allow attacker to determine theexact size of a network response!

•... purely in the browser!

•Can be used to perform compression-based attacks, suchas CRIME and BREACH, in the browser

HEIST

19

Browser Side-channels•Send authenticated request to /vault resource!

fetch('https://bunnehbank.com/vault',{mode: "no-cors", credentials:"include"})•Returns a Promise, which resolves as soon as browser
receives the first byte of the response
performance.getEntries()[-1].responseEnd•

Returns time when response was completely downloaded
HEIST

20

HEIST•

Step 1: find out if response fits in a single TCP window

HEIST

21

Fetching small resource: T2 - T1 is very small
TCP handshakecompletefirst byte
received
initial TCP
window received

GET /vault

T1fetch('...')
SSL handshakecomplete

initial TCP
window sent

T2

time

responseEnd

Promiseresolves
HEIST

22

Fetching large resource: T2 - T1 is round-trip time
TCP handshakefirst byte
second TCP
complete
received
window received
initial TCP
GET /vault
window received
T1

fetch('...')
SSL handshakecomplete

initial TCP
window sent

T2

ACK sent

Promiseresolves
HEIST

time

responseEnd

second TCP
window sent
23

HEIST•

Step 1: find out if response fits in a single TCP window!

•Step 2: discover exact response size

HEIST24

Discover Exact Response Sizeinitcwnd

second TCP window

Resource size: ?? bytes

HEIST

Reflected content: x bytes

25

Discover Exact Response Size
initcwnd

second TCP window

Resource size: ?? bytes

HEIST

Reflected content: x/2 bytes

26

Discover Exact Response Size
initcwnd

second TCP window

Resource size: ?? bytes

Reflected content: x/2+x/4 bytes

HEIST

27

After log(n) checks, we find:! y bytes of reflected content = 1 TCP window!
! y+1 bytes of reflected content = 2 TCP windows→ resource size = initcwnd - y bytes
initcwndsecond TCP window

Resource size: ?? bytes
HEIST

Reflected content: y bytes
28

HEIST•

Step 1: find out if response fits in a single TCP window!

•Step 2: discover exact response size!

•Step 3: do the same for large responses ( > initcwnd)

HEIST

29

Determine size of large responses• Large response = bigger than initial TCP window• initcwnd is typically set to 10 TCP packets!
• ~14kB!

• TCP windows grow as packets are acknowledged!
• We can arbitrarily increase window sizeHEIST30

= 19 TCP data packets
GET /fooCWND = 10

10 TCP packets
10 ACKs
GET /vault

CWND = 20

19 TCP packets
19 ACKs

HEISTsent in single
TCP window

31

HEIST•

Step 1: find out if response fits in a single TCP window!

•

Step 2: discover exact response size!

•Step 3: do the same for large responses ( > initcwnd)!

•

Step 4: if available, leverage HTTP/2

HEIST

32

Leveraging HTTP/2•HTTP/2 is the new HTTP version!
••

Preserves the semantics of HTTP!

Main changes are on the network level!
•Only a single TCP connection is used for parallel requests

HEIST

33

Leveraging HTTP/2•

Determine exact response size without reflected content
in the same response!

•Use (reflected) content in other responses on the sameserver!
•Note that BREACH still requires (a few bytes of) reflective content
in the same resource

HEIST

34

= 6 TCP packets/reflect?x=... = 3 TCP packets
GET /reflect?x=.

..

GET /vault

Promiseresolves
responseEnd

CWND = 10

9 TCP packets
9 ACKscontains both/reflectand /vault
HEIST35

= 6 TCP packets/reflect?x=... = 5 TCP packets
GET /reflect?x=.

..

GET /vault

Promiseresolves

10 TCP packets
10 ACKs
1 TCP packet

responseEnd

CWND = 10

1 ACK

HEIST

CWND = 20
contains both/reflect andpart of /vault
36

DEMOHEIST38Other targets•

Compression-based attacks!
•••

gzip compression is used by virtually every website!

Size-exposing attacks!
•Uncover victim's demographics from popular social networks!

•Reveal victim's health conditions from online health websites!

•....!

Hard to find sites that are not vulnerable
HEIST39

Countermeasures•••

Browser layer!
•

Prevent side-channel leak (infeasible)!

•

Disable third-party cookies (complete)!

HTTP layer!
•

Block illicit requests (inadequate)!

•

Disable compression (incomplete)!

Network layer!
•Randomize TCP congestion window (inadequate)!

•

Apply random padding (inadequate)

HEIST

40

Conclusion•

Collection of techniques to discover network response size inthe browser, for all authenticated cross-origin resources!

•Side-channel originates from subtle interplay between
multiple layers!

•Allows for compression-based and size-exposing attacks!

•HTTP/2 makes exploitation easier!

•Many countermeasures, few that actually workHEIST41

HEISTQuestions?
Mathy Vanhoef!
@vanhoefm!
mathy.vanhoef@cs.kuleuven.be

Tom Van Goethem!
@tomvangoethem!
tom.vangoethem@cs.kuleuven.be