Description
CRIME (Compression Ratio Info-leak Made Easy) is a security exploit targeting secret web cookies transmitted over HTTPS and SPDY connections utilizing data compression. By analyzing the compression ratios, attackers can infer sensitive information, such as authentication cookies, leading to session hijacking and further attacks.
Recommendation
To mitigate CRIME attacks, disable SSL/TLS compression on servers and clients. Implement Perfect Forward Secrecy (PFS) to prevent the decryption of past communications even if the server’s private key is compromised. Additionally, regularly update software and libraries to patch known vulnerabilities.
References
Could your website be exposed too?
SmartScanner can check your website for CRIME (SSL/TLS) attack and gives you actionable findings to investigate.
Start a free scanRelated Issues
- CRIME (SPDY) attack - CVE-2012-4930
- BREACH attack - CVE-2013-3587
- The POODLE attack - CVE-2014-3566
- TLS 1.1 enabled - Vulnerability
You might also like:
See something that needs correcting? Let us knowUpdated May 13, 2024