CRIME: Information Leakage Attack against SSL/TLS | Qualys
Summary: Juliano Ruhl and Thai Duong presented CRIME, a practical attack against how TLS is used in browsers, at Ekoparty on September 21, 2012; the root cause is information leakage that occurs when data is compressed before encryption. The exploit uses JavaScript and needs 6 requests to extract one byte of data, and SSL Labs tests across the SSL Pulse data set found about 42% of servers supported TLS compression.
Bottom line: An attacker who can observe traffic and manipulate the victim's browser can steal session cookies and hijack the session, and with 42% of surveyed servers supporting TLS compression, the vulnerable surface was broad enough that most vendors were expected to simply disable compression.
Read the original at Qualys Blog ↗
- Topics
- Vulnerabilities & Patching
- Related
- Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026