HTB: A Very Effective Method to Protect Web Servers Against BREACH Attack to HTTPS

Abstract

BREACH is a side-channel attack to HTTPS that allows an attacker to obtain victims' credentials under certain conditions. An attacker with a privileged position on the network can guess character by character a secret session key just by analyzing the size of the responses returned by the server over HTTPS and encrypted. Heal the Breach (HTB) is the proposed technique to mitigate BREACH attack by randomly changing the size of server responses through a modified gzip library. The attacker needs a precision of one byte in the size of the responses to be able to determine if a guess character is part of the secret token. Since the modified gzip library introduces randomness in the size of the response, BREACH becomes ineffective. The only way to circumvent this protection is to make several requests and compute the average size of the response, which minimizes the random effect. Mathematical and experimental results show that, for a random variation of the size from 1 to 10 bytes, an attacker needs to analyze 500 times more packages to obtain enough accuracy and surpass this mitigation. However, if the number of requests increases it is easier to isolate and block the attack using standard Intrusion Detection Systems (IDS). Compared to other mitigations, the approach presented in this paper is very effective, easy to implement for all websites hosted in the server, and produces a negligible increase in normal traffic.

A Fuzzy Logic based Solution for Network Traffic Problems in Migrating Parallel Crawlers

“…To conserve time and network traffic, downloader maintain one TCP connection open for each IP address and utilize it repeatedly until the server's entire contents have been downloaded [7]. Web servers compress web pages before transmitting them to the requesting client in order to save network traffic [8]. Downloader use conditional GETs, which are defined in the HTTP protocol.…”

Diseño de una Página Web Informativa para el Área de Telecom-Acd en la Empresa Teleperformance

“…Un servidor web, por otro lado, es un programa que procesa y responde a varias solicitudes de los navegadores y sirve los recursos solicitados a través del protocolo HTTP o HTTPS (versiones seguras, cifradas y autenticadas de HTTP) (Spacek et al, 2022); (Palacios et al, 2022). Un servidor web simple tiene un esquema de operación muy simple.…”