ROBOT Attack Detected (Weak Oracle)

Description

The target web server is vulnerable to the ROBOT (Return Of Bleichenbacher's Oracle Threat) attack, a cryptographic vulnerability affecting TLS implementations that use RSA encryption. This vulnerability exploits weaknesses in the PKCS#1 v1.5 padding oracle, allowing attackers to decrypt TLS sessions and forge signatures using the server's private key without direct access to it.

This instance exhibits a "Weak Oracle" variant, meaning successful exploitation requires collecting and analyzing several million specially crafted packets. While more difficult than a "Strong Oracle" variant, this attack remains practical for determined adversaries.

Remediation

Implement the following remediation steps in order of priority:

1. Disable RSA Key Exchange Cipher Suites: Remove all TLS cipher suites that use RSA key exchange (typically identified by "TLS_RSA_" prefix). Only retain cipher suites using Diffie-Hellman key exchange (DHE or ECDHE), which provide forward secrecy and are not vulnerable to ROBOT attacks.
2. Update TLS/SSL Libraries: Ensure all SSL/TLS implementations and libraries (OpenSSL, GnuTLS, NSS, etc.) are updated to the latest patched versions that properly handle PKCS#1 v1.5 padding errors without creating timing oracles.
3. Configure Server Cipher Suite Preferences: Explicitly configure your web server to prefer modern cipher suites. Example configurations:
   
   Apache (mod_ssl):

   SSLCipherSuite ECDHE-RSA-AES256-GCM-SHA384:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-RSA-CHACHA20-POLY1305
   SSLHonorCipherOrder on
   SSLProtocol -all +TLSv1.2 +TLSv1.3

   Nginx:

   ssl_ciphers 'ECDHE-RSA-AES256-GCM-SHA384:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-RSA-CHACHA20-POLY1305';
   ssl_prefer_server_ciphers on;
   ssl_protocols TLSv1.2 TLSv1.3;

4. Enable TLS 1.3: Where possible, enable TLS 1.3, which completely removes RSA key exchange and is immune to ROBOT attacks.
5. Verify Configuration: After making changes, test your server configuration using SSL testing tools to confirm RSA key exchange cipher suites are disabled and only forward-secret ciphers are available.

References