At a bank, an intrusion rule looks for a string inside HTTP bodies. The same string is then sent inside TLS and the rule does not fire. Which evasion explains the miss?
Select an answer to reveal the explanation.
Short Explanation
Painting over a postcard so a reader cannot see the sentence is different from handing the card over while the words stay visible. You sent the watched string inside TLS, so a rule that inspects readable HTTP bodies cannot see it. The trap is a proxy that left HTTP readable, an address rewrite, or a longer hop count.
Full Explanation
A rule that matches a string in HTTP bodies can see that string only while the body is readable. Sending the same string inside TLS is Encryption inside TLS, hiding that string from a rule built to inspect readable HTTP bodies. A proxy on the path whose HTTP body stays readable, leaving the watched string visible to the rule, would still expose the string, so the rule would have something to match. Network address translation, a rewrite of the addresses that leaves the HTTP body unchanged, changes addresses and leaves the body for the rule to read. A longer time to live, a hop-count field that does not conceal a string carried in the body, only affects how far the packet may travel and does not hide payload. Had the body stayed readable HTTP, the same rule would have had a string it could match. Exam caveat: addresses can remain visible when the body is encrypted; the miss here is the body string, not the loss of the 5-tuple. Operational check: confirm the flow is TLS on the sensor and that the rule is attached to readable HTTP, then decide whether you need a decryption point or a host record to see the string.