Researchers last week introduced a new penetration-testing tool that makes it possible to capture poorly encrypted Web session data -- such as cookies and HTML parameters. Now they say they're looking into how similar attacks against Web applications can be used to advance attacks against Web-facing databases with sloppy encryption-key deployment.
Demonstrated this spring at Black Hat Europe and officially released last week, the Padding Oracle Exploit Tool (Poet) takes advantage of and automates a side-channel attack called a Padding Oracle Attack, which was introduced to the cryptographic community in 2002. This attack leverages commonly used cryptographic padding oracles that receive cipher text, decrypts it, and replies to the sender whether the padding is valid or invalid. The attack is carried out if attackers can intercept padded messages encrypted in CBC mode, effectively gaining access to encrypted information without a key.

"What happens in Web apps is that it is very common for the programmer to send something encrypted to the client/Web browser [and] not to share it with the client, just to store it for some time like cookies, [which] is a perfect scenario to implement what is called 'chosen cipher text attacks,' where the cipher text is modified and [sent] again to the Web application," says Juliano Rizzo, who together with Thai Duong developed Poet. "Poet should help to show that is not easy to implement cryptography correctly, [and] attacks that could look theoretical are very practical and dangerous."

The link for this article located at Dark Reading is no longer available.