No protocol is perfect. Over the last 20 years, attackers have found ways to leak keys and decrypt traffic not by breaking the AES math, but by exploiting the implementation of the protocol. These 'side-channel' and 'logic' attacks changed the way the world views network security.
Heartbleed wasn't a flaw in the TLS protocol, but a bug in the OpenSSL implementation of the 'Heartbeat' extension. A client could send a heartbeat request claiming the payload was 64KB, but only send 1 byte. The server, trusting the length field, would copy 64KB of its *own memory* and send it back to the attacker.
The Impact: This leaked private keys, session cookies, and user passwords directly from the server's RAM without leaving any trace in the logs.
# Conceptual Heartbleed Request
packet = b'\x18' # Heartbeat type
packet += b'\x04\x00' # Length = 16384 (claimed)
packet += b'A' # Actual data = 1 byte
# Server reads 16384 bytes from memory and sends it back!Heartbleed taught the industry the importance of 'bounds checking' and why using memory-safe languages (like Rust) for cryptographic libraries is a critical goal.
BEAST (Browser Exploit Against SSL/TLS) exploited the predictable IVs in CBC mode. Lucky13 took it further, using the *time* it took for a server to respond to a padding error to determine if the padding was correct. By sending thousands of modified packets and measuring the response time (microseconds), attackers could decrypt the session.
💡 These are known as 'Timing Attacks'. They prove that even a tiny difference in processing time can leak a secret key.
| Attack | Target | Mechanism | Fix |
|---|---|---|---|
| Heartbleed | OpenSSL RAM | Buffer Over-read | Patch OpenSSL / Update |
| BEAST | TLS 1.0 CBC | Predictable IVs | Upgrade to TLS 1.1+ |
| CRIME | TLS Compression | Compression Side-channel | Disable Compression |
| Lucky13 | TLS MAC-then-Encrypt | Timing Analysis | Use AEAD (GCM) |
CRIME (Compression Ratio Info-leak Made Easy) exploited the fact that TLS used to compress data before encrypting it. If an attacker can inject their own data into a request (like a cookie), they can observe the size of the encrypted packet. If the injected data matches the secret cookie, the compression ratio increases, and the packet gets smaller.
⚠️ Many legacy systems still have compression enabled for 'performance'. This is a high-risk configuration that allows session hijacking via CRIME.
Verify exercises to earn ★ 200 XP and unlock next lab level.