the data when we prepend it with an A. Thus, we have learned the first part of the data, a B. Next, we can prepend the original data with BA, BB, and so on and find out the rest of the data.

So, if someone prepends the data with carefully chosen values and observes the length of the compressed values, he can guess the whole data. This is true even after the data is encrypted after compression. If someone prepends the original data with random data and observes the length of the compressed and encrypted data, the same relationship holds.

Now, in the CRIME attack, the attacker first uses some social engineering techniques to trick the victim into clicking on a link. The attacker may send the victim an email with some link that actually points to a malicious script on the attacker’s website.

If a victim clicks on the link when he is already authenticated to the web application, the malicious script will run, and it will send several HTTPS requests to the web application using the authentication cookie of the victim. And the cookie will be prepended with some random bytes.

At this point, if the attacker is on the same wireless networks as that of the victim or the attacker is controlling the router of the victim, or the attacker is in the same local networks as that of the victim, the attacker can listen to the conversation and observe the length of the compressed and encrypted cookie with each HTTPS request.

As explained above, because of the property of the compression algorithm used in HTTPS connections, the attacker can analyze those values and derive the value of the authentication cookie.

The attacker can now easily impersonate the victim and log in to the victim’s account in the web application to steal his sensitive data like credit card numbers, social security numbers, passwords, etc.

How to prevent the CRIME attack?

• One way of preventing the CRIME attack is to disable the compression mechanism in HTTPS requests.
• TLS connections should use Cipher Chaining Block or CBC ciphers. This will reduce the relationship of encrypted data with the plaintext data, thereby making it much more difficult for the attackers to analyze the encrypted data and deduce the actual value of data.
• The attacker first injects a malicious script to make several HTTPS requests using CSRF attacks. So, Cross-Site Request Forgery or CSRF attacks (What are CSRF or Cross-Site Request Forgery Attacks ?) must be prevented efficiently. We often use CSRF tokens to prevent CSRF attacks.
• Browsers should be upgraded with recent security patches.

So, beware of various security vulnerabilities and stay safe and secure. This article gives a brief overview of the CRIME attack. Interested readers who want to know more about different web application vulnerabilities may want to refer to the book “Web Application Vulnerabilities And Prevention.”