The beast tag has no wiki summary.
13
votes
5answers
1k views
What can I do about TLS 1.0 javascript injection vulnerability on my server?
The recent article featured on slashdot http://www.theregister.co.uk/2011/09/19/beast_exploits_paypal_ssl/ says that connections secured with TLS 1.0 are susceptible to man-in-the-middle decryption ...
13
votes
3answers
4k views
Is there a way to mitigate BEAST without disabling AES completely?
It seems that the easiest way to protect users against the BEAST attack on TLS <= 1.0 is to prefer RC4 or even disable all other (CBC) cipher suites altogether, e.g. by specifying something like
...
12
votes
3answers
9k views
How to test for the BEAST attack if server isn't Internet-connected?
I'd like to test a server specifically for vulnerabilities related to BEAST. What command line switches should I use?
What should I see (or not see) in the output?
Update
The intent is to scan a ...
9
votes
3answers
9k views
How to fix SSL 2.0 and BEAST on IIS
As you can see on this post TeamMentor.net vulnerable to BEAST and SSL 2.0, now what? the app I'm currently development got flagged for SSL 2.0 and BEAST by SSL Labs.
I'm using IIS 7.0 with the ...
15
votes
1answer
549 views
TLS: RC4 or not RC4?
I was reading another interesting article by Matthew Green today, saying that
if you're using RC4 as your primary ciphersuite in SSL/TLS, now would be a great time to stop
As far as I'm aware ...
12
votes
4answers
2k views
TLS 1.0 JavaScript injection vulnerability (BEAST): what to do client-side?
With the alleged SSL/TLS vulnerabilities used by the BEAST exploit, there seems to be a security gap between TLS versions; TLS 1.0 being the problematic one but still the only option for many sites.
...
4
votes
4answers
2k views
Should I ignore the BEAST SSL exploit and continue to prefer AES?
Because of the BEAST exploit it seems everyone is saying you should stop using AES and instead use RC4.
I am wondering if it wouldn't be better to continue using AES instead for the following ...
23
votes
3answers
1k views
Why was the BEAST attack previously considered implausible?
Can someone explain why the BEAST attack wasn't considered plausible? I saw an article quoting the creator as saying 'It is worth noting that the vulnerability that BEAST exploits has been presented ...
3
votes
2answers
1k views
Next Microsoft Patch Tuesday include BEAST SSL fix
http://thehackernews.com/2012/01/next-microsoft-patch-tuesday-include.html
I thought the vulnerability that BEAST uses is already fixed on "Microsoft" side, no? Can someone please clarify this?:
...
5
votes
1answer
464 views
IIS 6.0 - mitigating BEAST
Recently, my PCI assessor informed me that my servers are vulnerable to BEAST and failed me. I did my homework and I want to change our webservers to prefer RC4 ciphers over CBC. I followed every ...
