Researchers demo new attack technique, HEIST, that lets hackers steal sensitive data like SSNs and e-mail addresses from HTTPS pages without a MITM position
Approach exploits how HTTPS responses are delivered over transmission control protocol. — The HTTPS cryptographic scheme protecting millions …
Context & Ripple Effects
HTTPS research through 2015–2016 has followed a steady escalation: the FREAK flaw in Google and Apple devices showed crypto downgrade attacks requiring a man-in-the-middle, and researchers then showed cookies can bypass HTTPS entirely in modern browsers. In March, a TLS decryption attack left over 13M HTTPS websites and email services exposed, including 97K of the top 1M most popular sites.
HEIST changes the threat model again: by exploiting how HTTPS responses are delivered over TCP, it extracts sensitive data like Social Security numbers and e-mail addresses without the attacker holding any network position at all — the encryption still works, but the delivery layer leaks.
First-order effects
- Any website embedding attacker-controlled or third-party JavaScript gains a new way to probe cross-origin HTTPS responses, so operators of pages handling SSNs and e-mail addresses can no longer treat TLS alone as adequate protection.
- Browser vendors and web platform maintainers become the first line of defense, since the attack runs client-side rather than on the wire.
Second-order effects
- Site operators facing exposure will be pushed toward layered mitigations — response-splitting, stricter content isolation, and reduced trust in embedded scripts — shifting security spending beyond certificates and TLS configuration.
- The finding pressures the broader ecosystem of services relying on HTTPS confidentiality, following the same pattern as the March TLS decryption disclosure that flagged millions of sites and email services.
Third-order effects
- If the pattern holds — FREAK, cookie bypasses, NTP attacks, TLS decryption, now HEIST — the industry's structural assumption that transport encryption equals confidentiality erodes, pushing regulation and procurement standards toward defense-in-depth requirements rather than checkbox HTTPS compliance.
- Research of this kind increasingly functions as dual-use intelligence: the same public disclosures that harden browsers give attackers a roadmap, raising the stakes for how quickly vendors patch after publication.
The trend: Transport-layer encryption is proving necessary but not sufficient, as researchers repeatedly demonstrate side-channel attacks that extract plaintext from HTTPS without ever breaking the cryptography itself.