FIESTA - An HTTPS Side-Channel Party

Offered By: OWASP Foundation via YouTube

Course Description

Overview

Explore FIESTA, a new tool for testing HTTPS side-channel vulnerabilities, in this 42-minute conference talk from OWASP AppSec EU 2018. Delve into the world of TLS traffic exploitation and learn about past attacks like CRIME, BREACH, and TIME. Discover a previously unused side-channel affecting major internet companies. Examine the tool's configuration, fake web setup, and image loading techniques. Investigate real-world examples involving Google and Facebook, and discuss bug bounty implications. Gain insights into JavaScript-based countermeasures and understand the broader implications for online security.

Syllabus

Intro
Pizza delivery example
Traffic
Compression
Search language
Exploit
Double narrative
FIESTA
Configuration file
Fake web
HTTP
Image loading
Image loading test
The trick
Example
Bounty hunters
Google
Facebook
Bug bounties
Hiding window
JavaScript
Conclusion

Taught by

OWASP Foundation

Related Courses

Hardware Security
University of Maryland, College Park via Coursera Cryptography and Information Theory
University of Colorado System via Coursera Introduction to Software Side Channels and Mitigations
Graz University of Technology via edX Side-Channel Security: Developing a Side-Channel Mindset
Graz University of Technology via edX Physical and Advanced Side-Channel Attacks
Graz University of Technology via edX