HEIST - HTTP Encrypted Information can be Stolen Through TCP-Windows

Explore a groundbreaking set of techniques called HEIST (HTTP Encrypted Information can be Stolen Through TCP-Windows) that enables browser-based attacks against SSL/TLS and other secure channels. Delve into this 50-minute Black Hat conference talk by Tom Van Goethem and Mathy Vanhoef, which introduces a novel side-channel attack capable of leaking the exact size of cross-origin responses. Discover how HEIST exploits vulnerabilities in browsers, HTTP, SSL/TLS, and TCP layers to perform compression-based attacks like CRIME and BREACH without requiring network access. Learn about the potential for extracting sensitive information from popular websites and the increased impact of HEIST when used with HTTP/2. Gain insights into the widespread applicability of these attack techniques and their implications for online security and privacy.