FIESTA: an HTTPS side-channel party
Talkat OWASP AppSec Europe 2018 · on Friday, 2018-07-06· at 11:45· Fleming - 3rd Floor, QEII Centre Broad Sanctuary, Westminster·
summary
Claims a new HTTPS side channel and ships a Python tool called FIESTA that turns observed byte counts and connection counts into oracles, extracting phone numbers emails and file previews from Google Contacts Drive Dropbox and Facebook Messenger by forcing controlled searches through a TCP proxy and counting responses. Techniques include image-request probes, forcing HTTP/2 to behave serially (demultiplexing), CDN redirection to defeat caching, and a required man‑in‑the‑middle. Some vendors fix by blocking avatar preload or adding consent UI.
AI-written summary · about
chapters (22)
- 0:00Intro
- 4:00Pizza delivery example
- 5:18Traffic
- 6:50Compression
- 8:12Search language
- 10:55Exploit
- 12:50Double narrative
- 13:44FIESTA
- 16:35Configuration file
- 17:03Fake web
- 21:42HTTP
- 25:29Image loading
- 26:24Image loading test
- 28:07The trick
- 29:30Example
- 32:54Bounty hunters
- 33:35Google
- 34:18Facebook
- 35:37Bug bounties
- 37:58Hiding window
- 38:27JavaScript
- 39:59Conclusion
related talks
52mUnlocking secrets of proprietary software using Frida
21mSecurity is Everyone's Responsibility
27mCatching the Phisherman
45mHTTP Desync Attacks: Smashing Into The Cell Next Door
19mLive Hacking Session Part 1
01h 01mSomething Something Cyber
46mThe Art of Cyber Espionage: Unleashing the Power of SCADA and ICS Hacking
48mMobiconf 2018: Marcos Placona, Twilio