BEAST

cryptographysecurity

A 2011 attack decrypting TLS 1.0 traffic by exploiting predictable CBC initialization vectors.

Browser Exploit Against SSL/TLS chained a chosen-plaintext trick with CBC's predictable IVs to recover secrets like cookies. It pushed the industry toward TLS 1.1+ and AEAD ciphers, and is why RC4 was briefly favored before its own weaknesses surfaced.

BEAST attacked the way TLS 1.0 chained cipher blocks, exploiting the fact that the initialization vector for each record was the last block of the previous one and therefore predictable to an attacker who could observe traffic and influence what was sent. That combination allowed recovery of small secrets such as session cookies.

The requirements were demanding, which is characteristic of this whole family: the attacker needed to run code in the victim's browser and observe the resulting encrypted traffic. That is a high bar and it is not an unrealistic one, since a malicious advertisement on any page plus a network position is enough, and the attack demonstrated that a theoretical weakness known for years could be made practical when someone built the tooling.

Its lasting significance is in what it started. The response, moving to newer TLS versions and to authenticated encryption modes, was slow and painful because compatibility mattered more to operators than a difficult attack, and BEAST is the beginning of a decade in which a named vulnerability with a logo would arrive every few months. That naming convention is itself a lesson: the branding was mocked and it demonstrably accelerated patching.

Also known as: BEAST, Browser Exploit Against SSL/TLS, CVE-2011-3389

← All glossary entries