{"id":13106,"date":"2020-09-10T13:47:34","date_gmt":"2020-09-10T17:47:34","guid":{"rendered":"https:\/\/www.thesslstore.com\/blog\/?p=13106"},"modified":"2023-03-20T14:38:49","modified_gmt":"2023-03-20T18:38:49","slug":"raccoon-attack-researchers-find-a-vulnerability-in-tls-1-2","status":"publish","type":"post","link":"https:\/\/www.thesslstore.com\/blog\/raccoon-attack-researchers-find-a-vulnerability-in-tls-1-2\/","title":{"rendered":"Raccoon Attack: Researchers Find A Vulnerability in TLS 1.2"},"content":{"rendered":"\n

Bad news: there\u2019s a vulnerability in TLS 1.2. Good news: researchers say it\u2019s \u201cvery hard to exploit\u201d and major vendors have already released security patches for it.<\/h2>\n\n\n\n

A team of researchers has documented a vulnerability in TLS 1.2 (and earlier versions) that could allow a man-in-the-middle attacker to acquire a shared session key and decrypt SSL\/TLS traffic.<\/p>\n\n\n\n

The vulnerability only applies in very specific circumstances and is difficult to execute, but software vendors have released patches to block potential attackers from taking advantage of this loophole.<\/p>\n\n\n\n

(In case you\u2019re wondering: No you don\u2019t have to re-issue any certificates!)<\/p>\n\n\n\n

What is the Raccoon Attack? How does it work? What should site owners do?<\/p>\n\n\n\n

Let\u2019s hash it out.<\/span><\/p>\n\n\n<\/span><\/span>\n\n\n

What Is the Raccoon Attack?<\/h2>\n\n\n\n

The Raccoon attack is a newly discovered vulnerability in TLS 1.2 and earlier versions. It allows hackers (in certain situations) to determine a shared session key and use that to decrypt TLS communications between the server and client.<\/p>\n\n\n\n

The attack doesn\u2019t allow a hacker to obtain the private key, so they\u2019d have to perform the attack individually on each connection they want to eavesdrop on.<\/p>\n\n\n\n

In order to execute the Raccoon Attack, a hacker needs several conditions in place:<\/p>\n\n\n\n

    \n
  1. Successfully setup a man-in-the-middle attack to intercept communications<\/li>\n\n\n\n
  2. Connection must use TLS 1.2 or previous (but we\u2019ve all disabled SSL 3.0, TLS 1.0, and TLS 1.1 already\u2026right?)<\/li>\n\n\n\n
  3. Connection must use Diffie-Hellman key exchange<\/li>\n\n\n\n
  4. Server must re-use Diffie-Hellman public keys<\/li>\n\n\n\n
  5. The attacker needs to be near the target server in order to run precise timing measurements<\/li>\n<\/ol>\n\n\n\n

    If you\u2019d like to learn more about how the attack is executed, the researchers have setup a very informative website at raccoon-attack.com<\/a> with technical details and FAQs.<\/p>\n\n\n\n

    As far as we know, this attack has not been used in the real world. Researchers say that due to the multiple conditions that have to be in place for this attack to work, \u201ca real-world attacker will probably use other attack vectors that are simpler and more reliable than this attack\u201d.<\/p>\n\n\n\n

    What Should Site Admins Do?<\/h2>\n\n\n\n

    Raccoon is a possible but rather unlikely attack, and it targets configurations that were already considered bad practice and were being disabled by browsers. In the words of the researchers who found it:<\/p>\n\n\n\n

    \u201cRaccoon is a complex timing attack and it is very hard to exploit. It requires a lot of stars to align to decrypt a real-world TLS session.\u201d<\/p>\n\n\n\n

    Raccoon might not be a very likely real-world attack, but it\u2019s still a proven vulnerability, so site admins would be wise to check their servers and plug this potential security hole if necessary.<\/p>\n\n\n\n

    Test Your Server<\/h3>\n\n\n\n

    As a first step, you can do a quick test to see if your server software\/configuration might be vulnerable to Raccoon.<\/p>\n\n\n\n

    Here\u2019s how:<\/p>\n\n\n\n

    1) Go to SSL Labs<\/a>, run a test for your domain, and look for this setting:<\/p>\n\n\n\n

    \"SSL<\/figure>\n\n\n\n

    2) If that parameter says \u201cYes\u201d then your server may be vulnerable.<\/p>\n\n\n\n

    Patching Your Server<\/h3>\n\n\n\n

    If your server is vulnerable to this attack, you will likely be able to solve the issue by simply patching or upgrading the relevant software package:<\/p>\n\n\n\n