Cryptographic Attacks - CompTIA Security+ SY0-701 - 2.4

Understanding Cryptography and Its Vulnerabilities

The Importance of Cryptography

• Cryptography is a technology used frequently, often without awareness of its underlying processes.

• The security of encrypted data relies heavily on the encryption key used during the process.

• Attackers may not have access to the encryption key, prompting them to target the cryptographic system itself.

Examining Cryptographic Protocols

• Publicly available protocols allow for scrutiny, helping identify weaknesses or vulnerabilities in cryptographic methods.

• Trust in current algorithms stems from their historical resilience against attacks; however, implementation flaws can create vulnerabilities.

Types of Attacks on Cryptography

Birthday Attack Explained

• A birthday attack involves finding two different plaintext inputs that produce the same hash output (hash collision).

• This phenomenon can be understood through probability; with 23 people, there's a 50% chance two share a birthday.

• To mitigate such attacks, using larger hash sizes makes it increasingly difficult to find duplicate hashes.

Hash Collision Case Study: MD5

• The MD5 hashing algorithm was found vulnerable due to collisions as early as 1996 and became critical by 2008 when researchers exploited it to forge certificates.

• An example illustrates how minor differences in plaintext can lead to identical hashes in MD5, demonstrating its inadequacy.

Implementation Vulnerabilities: Downgrade Attacks

Understanding Downgrade Attacks

• Downgrade attacks exploit secure algorithms by forcing devices to use weaker encryption or no encryption at all.

• SSL stripping is a common form where an attacker intercepting communication convinces users to connect via unencrypted HTTP instead of HTTPS.

Mechanism of SSL Stripping

Understanding SSL Stripping Attacks

Steps in the SSL Stripping Process

• The initial step involves a website visitor sending a GET request to the web server using HTTP instead of HTTPS, initiating the process of SSL stripping.

• An attacker acts as a proxy, intercepting this initial HTTP request. The web server responds with an instruction to switch to HTTPS, but the attacker prevents this response from reaching the user.

• The attacker then sends a modified request to the web server that includes HTTPS. This allows them to access all data exchanged over this encrypted connection.

• When the user logs in by sending their username and password over HTTP (due to not being redirected), the attacker captures these credentials without encryption.