What you need to know about the Raccoon Attack TLS vulnerability

A team of researchers has recently discovered a vulnerability that can affect HTTPS and other services that utilize TLS or SSL. Known as the Raccoon Attack, this vulnerability specifically affects TLS 1.2 and earlier versions of the encryption protocol. Is it something the average website owner should worry about? (Spoiler: not really, but it’s always good to be informed.)

Read on to get the lowdown on what the Raccoon attack is and what precautions you should take to protect yourself. 

What is the Raccoon Attack vulnerability?

The Raccoon Attack allows hackers, under very precise circumstances and timing measurements, to break an encrypted connection and read potentially sensitive messages by determining a shared session key. This may sound scary, but this vulnerability can only be exploited if the following conditions are met: 

• The server is configured for TLS 1.2 or below
• The connection uses a cipher suite that utilizes a static Diffie-Hellman key exchange or the server reuses ephemeral Diffie-Hellman public keys during the TLS handshake
• The attacker is able to observe individual connections to obtain the private key 
• The attacker is close enough to the target server to get the timing right  

Fortunately, a scenario in which all these conditions are met would be exceptionally rare. 

Most websites that use HTTPS have adopted — or are in the process of adopting — the newest version of TLS, which is TLS 1.3. TLS 1.3 doesn’t support static Diffie-Hellman key exchange or reuse of ephemeral keys. Even if your server is configured to an earlier version of TLS, reusing public keys is considered bad practice, and is pretty rare. The Raccoon researchers found that only 3.33% of the top 100,000 websites on the Internet reuse Diffie-Hellman keys. Combined with the timing issue, there would need to be a perfect storm of circumstances for an attacker to successfully pull this off. 

For a more in-depth, technical explanation of the vulnerability, check out the Raccoon Attack website. 

What do I need to do about it?

This vulnerability isn’t about the SSL certificate itself, so you don’t need to reissue or reinstall anything. 

You can check if your site is vulnerable by visiting this site and performing a server test. In the results, look for the “DH public server param (Ys) reuse” setting. If it says “Yes”, your server may be vulnerable. 

If you haven’t already, update your server, application, and software configurations to TLS 1.3 and disable older TLS protocols. Many vendors, such as Microsoft and Mozilla, have also released patches addressing the potential vulnerability.

Wrap Up

Although it’s worrying that the Raccoon Attack vulnerability exists, it’s unlikely to affect most people. If you’re a website owner that has already adopted TLS 1.3, you have nothing to worry about. For general web users, modern browsers don’t support cipher suites that use the previously mentioned key exchanges, so there’s nothing to worry about on that end either.