Which option best describes a TLS data compression vulnerability attack?

Which option best describes a TLS data compression vulnerability attack?

• A. TCP/IP hijacking
• B. CRIME Attack
• C. DroidSheep
• D. RST hijacking

Answer: (B)

TLS data compression vulnerabilities come from performing compression on plaintext data before encryption, which creates a side-channel that an eavesdropper can exploit. The CRIME attack targets this by manipulating a victim’s request so that the secret (often a session cookie) is compressed along with attacker-controlled data. By observing how the size of the compressed ciphertext changes as the attacker varies the input, information about the secret leaks bit by bit, letting the attacker recover the secret over time. This is why the CRIME attack is the best description of a TLS data compression vulnerability. Other options describe different kinds of network attacks that don’t rely on TLS compression, such as hijacking a TCP session, tools that capture and reuse session data on mobile networks, or sending forged reset packets to disrupt connections.

TLS data compression vulnerabilities come from performing compression on plaintext data before encryption, which creates a side-channel that an eavesdropper can exploit. The CRIME attack targets this by manipulating a victim’s request so that the secret (often a session cookie) is compressed along with attacker-controlled data. By observing how the size of the compressed ciphertext changes as the attacker varies the input, information about the secret leaks bit by bit, letting the attacker recover the secret over time. This is why the CRIME attack is the best description of a TLS data compression vulnerability.

Other options describe different kinds of network attacks that don’t rely on TLS compression, such as hijacking a TCP session, tools that capture and reuse session data on mobile networks, or sending forged reset packets to disrupt connections.