A team of cybersecurity awareness specialists published information describing a theoretical attack on the Transport Layer Security (TLS) encryption protocol that could lead to the decryption of HTTPS connections between users and servers, exposing potentially sensitive communications.
This scenario, dubbed the Raccoon Attack, was described as “a highly difficult security risk to exploit”, due to its “abnormal” conditions, the experts mentioned.
Broadly speaking, cybersecurity awareness specialists describe the Raccoon attack as “timing”-dependent scenario in which a threat actor must consider the time required to perform encryption operations in order to determine some parts of the algorithm.
The main object of attack in Raccoon is the Diffie-Hellman key exchange process, from which hackers will try to obtain some bytes of information: “This helps threat actors define a set of equations and employ a solver for the hidden number problem (HNP), in order to calculate the premaster original secret established between the client and the server”, as mentioned by one of the researchers.
The report specifies that all servers that use Diffie-Hellman key exchange to configure TLS connections are vulnerable to such attacks, and that it is a server-side attack and cannot be performed on a client, such as in a browser. The attack must also run for each client-server connection in part, and cannot be used to retrieve the private key from the server and decrypt all connections at once. Any version of TLS earlier than 1.2 could be considered vulnerable, cybersecurity awareness experts mention.
While this is a significant risk scenario, the researchers emphasize the difficulty that its execution would entail: “This attack requires that certain very rare conditions be met, in addition to requiring a specific server configuration, so we consider the vulnerability to be highly difficult to exploit,” one of the researchers says.
In additional comments, experts point out that an attacker would need to be located near the target server for very accurate measurements, which is very impractical.
He is a well-known expert in mobile security and malware analysis. He studied Computer Science at NYU and started working as a cyber security analyst in 2003. He is actively working as an anti-malware expert. He also worked for security companies like Kaspersky Lab. His everyday job includes researching about new malware and cyber security incidents. Also he has deep level of knowledge in mobile security and mobile vulnerabilities.
