Re: [TLS] Rizzo claims implementation attach, should be interesting

[Nico Williams <[e-mail]>]

On Tue, Sep 20, 2011 at 8:42 PM, Martin Rex <[e-mail]> wrote:
> But that would also suggest that BEAST is not attacking the
> Cookie from the Server response, but instead the cookie from a
> client request.  (If the browser automatically inserts the cookie into
> arbitrary requests issued by the attackers malware, then this would
> mean that a serious Cross-Site-Request-Forgery problem in the browser
> is a prerequisite for the BEAST attack to succeed.

It's almost certainly the case that BEAST works by adding an IMG
element to a page where one of its scripts can run, with the IMG
referring to a resource on the service that the attacker wants to
steal cookies to, with the script and the eavesdropper working to
attack the GET of the IMG src to extract any cookies from the GET
request.  At least that's how I imagine it to work.  So, yes, that
would be the client request that's getting attacked.

We'll find out soon enough.

Nico
--