A flaw in the way HTTPS responses are delivered across the transmission control protocol (TCP) puts all kinds of users` data at risk.
Anything, from email addresses to social security numbers, can be stolen by crooks due to the flaw allowing them to decrypt hidden data in order to derive users` personal information.
The hack is named HEIST which basically means that HTTP Encrypted Information can be Stolen Trough TCP-Windows. What makes the attack so dangerous is the fact it is quite simple to carry out. If a user runs across the malicious code on any webpage, the code would query a number of pages, measuring the sizes of the data that is transmitted when the response comes in.
Even though HTTPS protect the data, if older exploit are use, cybercriminals can still manage to decrypt it and extract any information they want regarding the targeted users.
Luckily, the technique wasn’t devised by Black Hats but by security researchers at the Belgian Leuven University. That’s why we managed to hear about it before it has been leveraged worldwide.
Van Goethem and Mathy Vanhoef are the two experts who came across the exploit. Not only did they notify both Google and Microsoft about their discovery, but, a couple of days ago, they once again proved its viability by tracking on dangerous code to a New York Times advert.
The duo is concerned the once the exploit is in the wrong hands, it could cause a lot of damage to both webpages and their visitors.
Unluckily, at the moment no proper patch is available to fix the problem. Even though HEIST is a newcomer, the exploits which make the HTTPS data decryption possible are ancient and they still haven`t been patched. What is even worse, it doesn’t seem like they are going to be.
User could always prevent the sent data from being decrypted by disabling cookies, but that would pretty much kill the functionality on a lot of websites. Unfortunately, it seem like they don’t know what to do to protect themselves at this point. What they do know, however, is that in order for their data to be put at risk they have to encounter the malicious coding on a webpage first. This means that the best thing to do is staying away from shady websites with questionable contents and sticking to legitimate ones which are unlikely to host the code.
