21.3 BEAST
Browser Exploit Against SSL/TLS (BEAST) [55] is an attack on the CBC-based encryption of the record layer in SSL 3.0 and TLS 1.0. It is not a padding oracle but uses the predictability of the IV (as mentioned previously, the IV is the last cipher block of the previous TLS record in these versions) instead of attacking one byte of the first cipher block in CBC mode. Using the bytewise privilege technique described earlier, Mallory can move interesting bytes within this cipher block and step-by-step decrypt the complete first cipher block. Still, because the attack is restricted to the first cipher block after the IV, the impact of BEAST was rather limited because the contents of the first plaintext block are usually known. However, BEAST pointed to the fact that there is a serious problem with CBC mode within the TLS record layer.
The attacker model is basically the same as for POODLE, that is, Mallory is a man-in-the-middle who is able to eavesdrop on and manipulate messages...
