Later archive addition

Scalable Scanning and Automatic Classification of TLS Padding Oracle Vulnerabilities

Robert Merget, Juraj Somorovsky, Nimrod Aviram, Craig Young, Janis Fliegenschmidt, Jörg Schwenk and Yuval Shavitt

The paper reduces a broad TLS malformed-record probe set to a scalable scan and clusters response fingerprints to group related implementations. Scanning the Alexa Top Million found CBC padding oracles on 1.83% of sites, including nearly 100 variants and exploitable cases distinguishable through TLS alerts or TCP behavior without precise timing.

Record

Researcher

Robert Merget, Juraj Somorovsky, Nimrod Aviram, Craig Young, Janis Fliegenschmidt, Jörg Schwenk and Yuval Shavitt

In the archive

• Added to the 2019 archive after the original list was published

Related sources

• Talk recording

Tags

• tls
• side-channel
• timing-attack
• large-scale-scan
• measurement-study
• scanner
• crypto
• cve
• owasp-a02-2021

This page is the archive's own catalogue record. The research is the work of Robert Merget, Juraj Somorovsky, Nimrod Aviram, Craig Young, Janis Fliegenschmidt, Jörg Schwenk and Yuval Shavitt, first published at the original source. Preserved copies are kept so the citation survives its host.