Bleichenbacher—the man, the legend, the TLS attack

By Richard Arneson

No, no, this is a good man.

According to a technical paper published by a team of academics, there’s a new cryptographic lurking. It allows to intercept data believed to be secure through TLS (Transport Layer ), which provides authentication encryption between network devices. The researchers who identified it have dubbed it ROBOT, an acronym for Return of Bleichenbacher’s Oracle Threat.

Technically, it’s not really new

As is often the case, attackers, who often lack creativity, ingenuity, or both, borrow from previously and successfully launched evil. In this particular case, the miscreants filched from the Bleichenbacher attack, which was launched last century (1998) and victimized SSL servers. In it, the attackers sent encrypted text, known as ciphertext, to be decrypted. The decrypted results they got back picked subsequent ciphertexts, and so on, and so on…

The performs decryption through RSA, which is a key-exchange algorithm utilized by TLS and its predecessor, SSL (Secure Socket Layer). Along with key-exchange algorithms, TLS and SSL utilize symmetric-key algorithms, which are faster than their counterpart, but not quite on an encryption par. The key-exchange algorithms help determine the symmetric keys to use during a TLS or SSL session. Key-exchange algorithms are like a mediator who determines whether you’d like to converse with somebody, even though both of you speak a range of languages. Once you both agree that a conversation is merited, symmetric keys represent the language in which you’d both like to converse. The symmetric keys are created for agreed upon encryption and decryption, including any detected tampering.

Before you go hating on the name Bleichenbacher, (his Christian name Daniel) know that he is one (1) of the good guys. He is the erstwhile Bell Labs researcher who discovered the attack over two (2) decades ago.

These latest plagiarists come from a long line of scoundrels, though. There have been over ten (10) attacks that borrowed from the original Bleichenbacher attack. They were all effective to some degree, hence the imitations.

Here’s why it’s working

The authors of the TLS protocol had their hearts in the right place, but their retrofitted measures to make guessing the RSA decryption key more difficult have fallen short. Essentially, they’ve patched worn tires instead of buying new ones. What was needed was the replacement of the insecure RSA algorithm. Now, instead, many TSL-capable routers, servers, firewall and VPNs are still vulnerable.

The hits just keep coming

Not to be a downer, but it’s important to note that this latest attack works against Google’s new QUIC encryption protocol. And how’s this for irony? Google is Daniel Bleichenbacher’s current employer.

 Security Experts with the answers

To find out how to secure your organization’s network and protect its mission critical data, contact GDT’s tenured and talented engineers and security analysts at SOC@GDT.com. From their Security and Network Operations Centers, they manage, monitor and protect the networks of companies of all sizes, including those for some of the most notable enterprises, service providers, healthcare organizations and government agencies in the world. They’d love to hear from you.

If you want more information about network security, check out the following articles:

State of the Union address focuses on technology–briefly

The technology arms race was just amped up

Apparently, cyber attackers also consider imitation to be the sincerest form of flattery

Last week’s DHS “alert” upgraded to “an emergency directive”

The Collection #1 data breach—sit down first; the numbers are pretty scary

Shutdown affects more than workers

DDoS Attacks will deny a Massachusetts Man Ten (10) years of Freedom

Phishing for Apples

This isn’t fake news

Don’t get blinded by binge-watching

Mo Money, Mo Technology―Taylor Swift uses facial recognition at concerts

Step aside all ye crimes—there’s a new king in town

Q & A for a Q & A website: Quora, what happened?

They were discovered on Google Play, but this is no game

And in this corner…

Elections are in, but there’s one (1) tally that remains to be counted

Hiring A Hacker Probably Shouldn’t Be Part of Your Business Plan

Gen V

Sexy, yes, but potentially dangerous

Tetration—you should know its meaning

It’s in their DNA

When SOC plays second fiddle to NOC, you could be in for an expensive tune

How to protect against Ransomware