Websites use session cookies to remember authenticated users. If an attacker gains access to a user's session cookie while the user is still authenticated to a website, the hacker could use it to access the user's account on that website.

HTTPS should prevent this type of session hijacking because it encrypts session cookies while in transit or when stored in the browser. However, the new attack, devised by security researchers Juliano Rizzo and Thai Duong, is able to decrypt them.

Rizzo and Duong dubbed their attack CRIME and plan to present it later this month at the Ekoparty security conference in Buenos Aires, Argentina.

The attack exploits a weakness in a particular feature of the TLS (Transport Layer Security) cryptographic protocol and its predecessor, the SSL (Secure Sockets Layer) protocol, which are used to implement HTTPS.

All SSL and TLS versions are affected and the exploited feature is commonly used in SSL/TLS deployments, Rizzo said Thursday via email. The researcher declined to reveal which feature is vulnerable before the attack's presentation at Ekoparty.