An investigator is attempting to determine if recent data breaches may be due to issues with a company's web server that offers news subscription services. The investigator has gathered the following data:
• Clients successfully establish TLS connections to web services provided by the server.
• After establishing the connections, most client connections are renegotiated.
• The renegotiated sessions use cipher suite TLS_RSA_WITH_NULL_SHA.
Which of the following is the MOST likely root cause?
The renegotiated sessions using the cipher suite TLS_RSA_WITH_NULL_SHA, which does not provide encryption, suggests that the connections are being downgraded to use a less secure cipher suite. This is a hallmark of a downgrade attack, where an entity intercepts and manipulates the communication between the client and the server to force them to use weaker ciphers. This makes the connection more susceptible to Man-In-The-Middle attacks and is the most likely root cause of the data breaches in this scenario.
I go with D
Agreed. A Man-In-The-Middle can perform a downgrade to the cipher
I agree with the previous commenters. I think that with client connections being renegotiated, this would mean that there is some sort of downgrading happening if this is the reason for the compromise.
D. An entity is performing downgrade attacks on the path. The given data indicates that clients are successfully establishing TLS connections to web services provided by the server. However, after establishing the connections, most client connections are renegotiated, and the renegotiated sessions use cipher suite TLS_RSA_WITH_NULL_SHA. This indicates that an entity is performing downgrade attacks on the path, forcing the server and client to use a less secure cipher suite that may be vulnerable to attacks such as man-in-the-middle attacks.
The use of the cipher suite TLS_RSA_WITH_NULL_SHA during renegotiation is highly unusual. This may indicate an attacker is performing a downgrade attack on the connection. Therefore, the MOST likely root cause is D. An entity is performing downgrade attacks on the path.
D. agreed with the comments.
A downgrade attack involves intercepting and manipulating the communication between the client and the server to force them to use weaker cipher suites. The fact that connections are renegotiated to use TLS_RSA_WITH_NULL_SHA (a cipher suite that does not provide encryption) strongly suggests a downgrade attack. This is consistent with an attacker trying to weaken the encryption to intercept or manipulate data.