LUCKY13 is a timing attack that can be used against implementations of the TLS protocol. Timming attack can be used by the cipher block chaining mode of operation. Because the vulnerability affects the TLS 1.1 and 1.2 specification as well as certain forms of earlier versions.

Lucky 13 attack is applicable with Cipher-Block-Chaining mode of encryption and with MAC-then-Encrypt scheme. The TLS MAC calculation includes 13 bytes of header information and 5 bytes of TLS header plus 8 bytes of TLS of sequence number. So this is the reason  why it is called Lucky 13. Because this attack allows a full plaintext recovery for OpenSSL. So an attacker can exploit this vulnerability by reading the plaintext of an TLS encrypted session. The attack is a more advanced padding oracle which exploits different calculation times depending on the plaintext. But being padded with one or two bytes or containing incorrect padding.

Cipher-Block-Chaining (CBC)

Cipher block chaining (CBC) is a mode of operation for a block cipher in which a sequence of bits are encrypted as a single unit or block with a cipher key applied to the entire block.

Tested in Apache Web Server 2.4, Browse the URL and Look at the site information and you will see the connection encryption detailed info.

Solution

With apache, the SSL/TLS configuration is stored in /etc/apache2/mods-enabled/ssl.conf.

– To enable only ciphers with high encryption and recent protocols set:SSLCipherSuite SSLProtocol –ALL +SSLv3 +TLSv1SSLCipherSuite ECDHE-RSA-AES128-SHA256:AES128-GCM-SHA256:RC4:HIGH:!MD5:!aNULL:!EDHSSLHonorCipherOrder on

– Then reload the Apache server configuration.

Browse the URL and Look at the site information and you will see the connection encrypted info.

Conclusion

Fixing Lucky13 Vulnerability alone is not going to protect your website from all the security threats. And also ensure to follow Web Application security checklist and leverage eCyLabs Web Application Firewall could protect from this kind of issues at the Firewall level.

---

Leverage eCyLabs ASPM to get 360 degree view of your application security posture from code to cloud. Our Marketplace approach is cost-effective and efficient way for security and compliance monitoring.