The beast tag has no wiki summary.
2
votes
2answers
94 views
BEAST mitigation on a Cisco ACE 4710 load balancer
We are looking to mitigate BEAST (and similar) on our Cisco ACE appliance (running version A4(2.0)), which is the 'endpoint' for a handful of load-balanced services. Some of these service still run ...
2
votes
3answers
484 views
Why don't major browsers currently support TLS above version 1.0?
TLS 1.0 seem to be vulnerable to Beast, Lucky13 and maybe other attacks and is simply outdated. Common workaround used e.g. by Google was to use RC4 which was also recently broken, but none of the ...
15
votes
1answer
544 views
TLS: RC4 or not RC4?
I was reading another interesting article by Matthew Green today, saying that
if you're using RC4 as your primary ciphersuite in SSL/TLS, now would be a great time to stop
As far as I'm aware ...
7
votes
1answer
459 views
Is AES-GCM recommended for SSL?
I'm looking at turning on site-wide SSL for a website I manage, and I'm wondering what the best practices for SSL configuration. I'm not too worried about compatibility with old browsers and more ...
3
votes
3answers
2k views
BEAST: IIS6: Failing PCI scan - are these ciphers OK?
Our PCI compliance scanner, TrustWave, have failed our Win 2003/IIS6 site on BEAST because of the following cyphers:
Cipher Suite: SSLv3 : DES-CBC3-SHA
Cipher Suite: SSLv3 : RC4-SHA
Cipher Suite: ...
5
votes
1answer
460 views
IIS 6.0 - mitigating BEAST
Recently, my PCI assessor informed me that my servers are vulnerable to BEAST and failed me. I did my homework and I want to change our webservers to prefer RC4 ciphers over CBC. I followed every ...
5
votes
2answers
4k views
Configure SSL to prefer RC4 ciphers over block-based ciphers - BEAST
Our PCI scanners just informed us that we have BEAST (Browser Exploit Against SSL/TLS) Vulnerability
Apparently, the remediation is as follows:
Affected users should disable all block-based ...
8
votes
1answer
3k views
Tools to test for BEAST/CRIME that AREN'T Internet-based?
We have increasing pressure to identify and remediate any HTTPS server configurations that are vulnerable to BEAST (CBC) and CRIME (compression). We need to fix servers that are accessible to the ...
5
votes
2answers
4k views
Is BEAST really fixed in all modern browsers?
BEAST is said to be fixed in all modern browsers:
Chrome and Firefox
IE in Jan 2012
Opera in Dec 2011.
It's also fixed in OpenSSL since 2002.
Do these fixes mean that it's safe to use ciphers in ...
13
votes
3answers
4k views
Is there a way to mitigate BEAST without disabling AES completely?
It seems that the easiest way to protect users against the BEAST attack on TLS <= 1.0 is to prefer RC4 or even disable all other (CBC) cipher suites altogether, e.g. by specifying something like
...
9
votes
3answers
9k views
How to fix SSL 2.0 and BEAST on IIS
As you can see on this post TeamMentor.net vulnerable to BEAST and SSL 2.0, now what? the app I'm currently development got flagged for SSL 2.0 and BEAST by SSL Labs.
I'm using IIS 7.0 with the ...
12
votes
3answers
9k views
How to test for the BEAST attack if server isn't Internet-connected?
I'd like to test a server specifically for vulnerabilities related to BEAST. What command line switches should I use?
What should I see (or not see) in the output?
Update
The intent is to scan a ...
3
votes
2answers
1k views
Next Microsoft Patch Tuesday include BEAST SSL fix
http://thehackernews.com/2012/01/next-microsoft-patch-tuesday-include.html
I thought the vulnerability that BEAST uses is already fixed on "Microsoft" side, no? Can someone please clarify this?:
...
23
votes
3answers
1k views
Why was the BEAST attack previously considered implausible?
Can someone explain why the BEAST attack wasn't considered plausible? I saw an article quoting the creator as saying 'It is worth noting that the vulnerability that BEAST exploits has been presented ...
4
votes
4answers
2k views
Should I ignore the BEAST SSL exploit and continue to prefer AES?
Because of the BEAST exploit it seems everyone is saying you should stop using AES and instead use RC4.
I am wondering if it wouldn't be better to continue using AES instead for the following ...
12
votes
4answers
2k views
TLS 1.0 JavaScript injection vulnerability (BEAST): what to do client-side?
With the alleged SSL/TLS vulnerabilities used by the BEAST exploit, there seems to be a security gap between TLS versions; TLS 1.0 being the problematic one but still the only option for many sites.
...
1
vote
2answers
940 views
SSL Breach - Does the latest BEAST vulnerability mean SSL Issuers now have to worry about integrity? [closed]
Although many SSL certificates have been boasting extravagant guarantees -- typically around $10k minimum to $250k per breach -- to ensure their certificates are valid, to this date, I've heard that ...
13
votes
5answers
1k views
What can I do about TLS 1.0 javascript injection vulnerability on my server?
The recent article featured on slashdot http://www.theregister.co.uk/2011/09/19/beast_exploits_paypal_ssl/ says that connections secured with TLS 1.0 are susceptible to man-in-the-middle decryption ...
