BREACH: REVIVING THE CRIME ATTACK

✨ Summary

Paper summary

The paper demonstrates that TLS-protected web traffic can remain vulnerable to compression side-channel attacks even when TLS-level compression is disabled. The attack targets HTTP responses compressed with gzip/DEFLATE that contain both attacker-controlled input and secrets such as CSRF tokens. By inducing repeated requests and observing encrypted response lengths, an attacker can use compression behavior as an oracle to recover secrets character by character. The authors report recovering an entire CSRF token from Microsoft Outlook Web Access with approximately 95% reliability, often in under 30 seconds. The paper also describes practical techniques for addressing Huffman-coding noise, block-cipher alignment, false positives, false negatives, and encoding constraints. (breachattack.com)

The paper evaluates several mitigations, including separating secrets from attacker-controlled data into different compression contexts, disabling HTTP compression, masking secrets, rate-limiting requests, and strengthening CSRF protection. It concludes that separating secrets from user input or disabling compression provides the clearest protection, although both may impose implementation or performance costs. (breachattack.com)

Influence

The paper became a cited reference in HTTP protocol security guidance. RFC 9114 explicitly identifies BREACH as an example of compression attacks and requires implementations on secure channels not to compress confidential and attacker-controlled content together unless separate compression contexts are used; it also discusses padding as a mitigation. (rfc-editor.org) Subsequent research developed more systematic defenses, including Debreach, which uses static analysis, program instrumentation, and compressor changes to prevent sensitive data from influencing compression output while retaining compression for other content. (arxiv.org) Other work proposed server-side response-size randomization, such as the HTB mitigation, specifically to reduce the effectiveness of BREACH attacks. (iit.comillas.edu)