HEIST Attack Can Steal Data from HTTPS-Encrypted Traffic

Two Belgian security researchers have presented their latest work at the Black Hat security conference in Las Vegas: a new Web-based attack that can steal encrypted content from HTTPS traffic using nothing more than JavaScript.

Their attack is called HEIST, which stands for HTTP Encrypted Information can be Stolen through TCP-Windows.

The attack relies on a malicious entity embedding special JavaScript code on a Web page. This can be done right on the website if the attacker owns the site, or via JS-based ads if the attacker needs to embed the attack vector on third-party sites.

The most deadly attack scenario is the latter, when the attacker sneakily embeds malicious JS inside an ad, which is shown on your banking portal or social media accounts.

HEIST is another side-channel attack on HTTPS

At its core, the JavaScript code performs two main fu...