Tag Info

New answers tagged

0

The nmap script 'ssl-enum-ciphers' is how I manage finding out what versions and ciphers are supported. Command is "nmap -p 443 --script ssl-enum-ciphers " The output can also be put into a grepable format. http://nmap.org/nsedoc/scripts/ssl-enum-ciphers.html


1

just for completeness: testssl.sh is a nice, console-based tool to check ssl-setups of any ssl/ts - enabled servers, in oposite to ssllabs


1

Two ways that I know of: If you have Webinspect, they have a check specifically for this. The simple way is to uncheck all protocols in IE with the exception of SSLv3 and see if you connect to the website.


1

SSL-Session: Protocol : SSLv3 Cipher : AES256-SHA Obviously your server still has SSLv3 enabled. If you successfully disabled SSLv3 openssl s_client -ssl3 -connect ... should get something like this: ...SSL3_READ_BYTES:sslv3 alert handshake failure:s3_pkt.c:1260:SSL alert number 40 ...SSL3_WRITE_BYTES:ssl handshake failure:s3_pkt.c:596: ... ...


3

Yes it can. The algorithm used for signing a certificate by the issuer is independent from the algorithm which was used to sign the issuers certificate itself.


0

Thanks to all for commenting. I finally managed to find a solution http://forum.sp.parallels.com/threads/ssl-poodle-sslv3-bug.323338/ First I would like to thank UFHH01 for the solution provided, our exposure is resolved for now! Hope you don't mind, I have compiled all steps below: Updated: Be sure you are using the correct directory for the templates. ...


2

Yes, it is ok to have CBC ciphersuites in the list as long as SSLv3.0 is disabled. The issue is not the CBC mode itself, but the SSLv3.0 specification for the padding format. The padding format in TLSv1.0 is more restrictive, so the malleability required to mount the POODLE attack no longer exists.


1

The vulnerability applies in situations where: The attacker can do a MitM at the network level (usually through DNS poisoning or by operating a fake open WiFi access point). A Web site offers some services over HTTPS. Some parts of the Web site require a user authentication. The Web server accepts to to SSL/TLS renegotiations. The Web server is ready to ...


5

During the handshake, the client and server send each other "random values", which are sequences of 32 random bytes. The "client random" is part of the ClientHello message, while the "server random" is part of the ServerHello message. In both cases, the first four bytes of the random value encode the current date and time (number of seconds since January ...


1

TLS as a protocol does not depend on a the system time. The only point where the system time is used is in the Random field of the Client Hello and Server Hello handshake messages. From RFC 5246 (TLS 1.2): Clocks are not required to be set correctly by the basic TLS protocol; higher-level or application protocols may define additional requirements ...


1

It is always possible to be more paranoid, so you can shrink the list even more, depending on how worried you are. Basically: Remove the DH_anon cipher suites: they don't authenticate the server, hence they are weak against MitM attacks. Don't use RC4, since it has known biases. Don't use 3DES because its short block size (8 bytes) makes it troublesome ...


1

To summarize: no, you cannot. This is the exact point of DHE. In pompous terms, DHE provides perfect forward secrecy, which means that knowledge of the permanent server's private key (the one corresponding to the public key in the server's certificate) is not sufficient to decrypt past sessions. Technically, when DHE is used, the server's certificate and ...


2

I assume the question is about the "server" certificates used by PEAP, EAP-TLS, and EAP-TTLS to protect password authentication, as this wouldn't be a problem at all with client-certificate-based EAP-TLS. I doubt the EAP standards documents would ever have this information, given the crazy inconsistency across implementations (which surely wouldn't be as ...


2

just for the records: cloudflare released some good charts on how RSA and DH handshakes work:


4

When TLS/SSL handshake starts, the first step is, server is authenticated using a private key associated to the server's certificate. In a 2nd step, client and server exchange a session key used to encrypt the payload of the connection. The session key is used for one session means when the session is closed the same key can't be used to encrypt the traffic ...


0

Generally speaking, no, you will not have to do anything more that change the protocol (http to https) in order to encrypt your application's traffic. Most web-client libraries support both protocols transparently. Some additional things to consider as a mobile application developer: Do not disable certificate validation routines, or catch and discard ...


12

There have been some discussions about mitigating issues with some record splitting. Namely, what makes Poodle efficient is that padding may use up to a full block (8 bytes with 3DES or RC2, 16 bytes with AES). When this happens, only the last byte of the block is checked by the recipient, which is why the alteration from the attacker gets through with ...


8

SSLv3 protocol is flawed. This cannot be fixed. Generally, an attacker would exploit this by forcing the victim to connect to a server using SSLv3 by forcing connections using higher protocols to fail. TLS_FALLBACK_SCSV attempts to stop the browser/server from falling all the way back to SSLv3 if a higher protocol has already been tried. As you can ...


1

Ironically enough, X.509 certificates can theoretically be scoped to specific domains and sub-domains, through the Name Constraints extension: if a CA certificate contains a Name Constraints extension with a permittedSubtrees field containing a dNSName of value example.com may issue certificates only if the host names appearing in the Subject Alt Names ...


1

There is potential protection in the form of certificate pinning. This can be done in an application, and some browsers (hopefully all in the future) support it in the form of certificate pinning. Certificate pinning can take two forms, first, you can submit the fingerprint for your certificate to the browser vendors (Google and Mozilla, currently) to be ...


1

All a site needs to do is to present a certificate signed by a trusted CA. There is currently no way to "scope" CAs (limiting what origins they can sign certificates for) nor is there a way for a site to specify which CAs are valid for it. (And even if there were, this is a bit of a chicken-and-egg problem, how would you know that information is valid?) ...


3

You are confused because some people (yeah I am looking at you, Microsoft) have been using the terms inconsistently. A signature algorithm is a cryptographic algorithm such that: The signer owns a public/private key pair. The public key is public, the private key is private; even though both keys are mathematically linked together, it is not feasible to ...


0

Because of my project design, I can't check more than one packet . Can you please advise if just checking client hello like above is ok or not ? If you don't expect the client to circumvent your detection it might be enough to check for typical bytes at the beginning of the client hello inside the first packet you get. But, if you would use this to ...


0

Your header would only be marginally useful in this situation, and not at all useful in most other situations. Just for some examples: If Cloudflare loaded the actual site over https, but it was on a self signed unverified cert, would it still get the end-to-end header? If it was a self signed cert, but the fingerprint of the cert was manually verified by ...


6

At the end of the handshake, Finished messages are exchanged, under the protection of the newly negotiated algorithms and keys; in particular, the contents of these messages are protected by a MAC. The contents of the Finished messages are a hash of all preceding handshake messages. Any external manipulation of the ClientHello message as it transits from ...


3

While not strictly a duplicate of How does SSL/TLS work?, the answer is there: The Finished message is a cryptographic checksum computed over all previous handshake messages (from both the client and server). Since it is emitted after the ChangeCipherSpec, it is also covered by the integrity check and the encryption. If you alter any portion of ...


0

Late to the party... You can use this fingerprint tool: https://www.grc.com/fingerprints.htm Go there, type in any website (URL) that you are interested in and compare the fingerprint displayed with the one your browser displays. If the fingerprints don't match, your employer's proxy does intercept your connection. This most likely even works, when the ...


2

HTTPS (Hyper Text Transfer Protocol Secure) is a way of Securing a connection using the SSL/TLS Encryption, so that people have a harder time/aren't able to eavesdrop on you. OAuth (Open Authorization) is an Open Source authentication Framework that utilizes Tokens for a secure login, giving limited/permission based web page access to users. In conclusion, ...


2

You are missing a very important part of a Digital Certificate here. That part is Digital Signature. Basically, a Digital Certificate consists of 3 parts: A public key. Certificate information. ("Identity" information about user, such as name, user ID, and so on.) One or more digital signatures. A digital signature an encrypted hash of the ...


2

SSL certificates have an extension field that defines what a certificate is allowed to be used for. When you buy a certificate from VeriSign with your certificate signing request, it typically will not include the extension permission for signing downstream certificates with your certificate; especially for any domain you don't have authority for. Take ...


-2

The site at http://cipherli.st has config snippets for setting up Qualys-rated A-Grade TLS for Apache, nginx and lighttpd. It also includes statements for HSTS, OCSP-Stapling and X-Frame-Options.


-5

Use the following SSL options in apache. SSLProtocol -all +TLSv1.2 +TLSv1.1 +TLSv1 -SSLv3 -SSLv2 SSLHonorCipherOrder on SSLCipherSuite "EECDH+ECDSA+AESGCM EECDH+aRSA+AESGCM EECDH+ECDSA+SHA384 EECDH+ECDSA+SHA256 EECDH+aRSA+SHA384 EECDH+aRSA+SHA256 EECDH+aRSA+RC4 EECDH EDH+aRSA RC4 !aNULL !eNULL !LOW !3DES !MD5 !EXP !PSK !SRP !DSS"


1

If you don't want to give away your site's name to these other websites, you can also test it with... openssl s_client -ssl3 -host <your host name> -port 443 If it doesn't connect then you're ok. But also make sure that your openssl is working properly with your site... openssl s_client -host <your host name> -port 443 Disabling sslv3 also ...


1

The Same-Origin Policy does not differentiate between HTML and JavaScript in the context of data-access. An HTML form exists within the DOM within the website's context, and JavaScript is bound to this same context. In both implementations Cross-site Scripting can be used to undermine the Same-Origin Policy and obtain sensitive information.


7

Client software that is susceptible to downgrade attacks is defective, in the sense that it purposely does things outside of the standard in order to support server software that is defective. Normally, the client announces (in the ClientHello) its highest supported protocol version number (e.g. "3.2" to mean "TLS 1.1") and then the server responds (in the ...


1

Short version: interoperability sucks. Long version: Currently there are four SSL/TLS variants in common use: SSLv3 (1996) TLSv1.0 (1999) TLSv1.1 (2006) TLSv1.2 (2008) Each protocol supports a variety of ciphers. Older protocols have wider, more uniform cipher support. Newer protocols may implement smaller subsets of the ciphers available, and ...


5

There are secure non-POODLE-vulnerable ciphers which you can use with SSLv3 - POODLE only impacts variants with CBC. The RC4 ciphers, for example, are not vulnerable to POODLE. Now, RC4 is a tricky thing. It's considered breakable (but not really actively broken), but since it's the best workaround for things like BEAST and POODLE, it's heavily used and ...


1

The Poodle attack model is one where the attacker triggers the requests (normally with some Javascript in the client -- note that, in that case, requests will be GET, not POST, since that "evil Javascript" will be served as part of an unprotected Web page load from another site, and the same-origin policy will prevent arbitrary POST) and manipulates the ...


1

In the scenario you have outlined it is in fact possible, at least in theory, to sniff the connection. Okay, so WEP is easy to crack, and if you are using, you should stop and get on to WPA2, which is far more secure, and nearly impossible to break. In each of these cases you will need to have some sort of password/key set up. If it's just your own access ...


3

I see where you are going with this, and it's good, out of the box thinking. Unfortunately it isn't likely to work in many cases - if a browser supports SSLv3 chances are it supports bad ciphers too. My advice would be to put this system behind a web proxy where you can control the ciphers and protocols, and let the client connections terminate there. The ...


0

Answer: Let's think about it. For governments that can afford it, point-to-point encryption of voice calls is not hard to do, even with cell phones. So for the voice calls that aren't encrypted and are easy pickings, maybe that's what they want heard? (Counter-intelligence is not entirely unheard of now is it?) On an individual scale, it is possible to ...


0

In your case I would recomend a VPN server. This appears to be a very secure site, and you hardened the server side very well. Using a VPN infrastructure will put another barrier between the server and the attacks. If you already have the users receiving and entering the authorization code, they will be able to connect to a VPN without much trouble. In my ...


22

If your server does not support SSLv3, then it does not support SSLv3. "Protocol downgrade attacks" are methods to force a client and server to use a protocol version that they both support even though they both know at least one newer version that they would have wished to use, given the choice. Anecdote: I am French. Back in 2005, I was walking in the ...


3

Firefox browser provides the easiest way to do such testing via the advanced settings in about:config where security.tls.version can be of the following values 0 - SSLv3 (set max and min value to this) 1 - TLSv1.0 2 - TLSv1.1 3 - TLSv1.2 What you will see when the website does not support SSLv3 is this: Please remember to set it back to max 3 and ...


3

It doesn't necessarily matter what your server uses by default - most servers and clients are configured to negotiate the highest protocol available. A major aspect of the POODLE attack is that an attacker can cause connection failures in a higher (non-vulnerable) protocol, and downgrade the victim to SSL3. Then they can exploit the vulnerability in SSL 3. ...


1

As per Certificate authority Guideline, Wildcard SSL certificate is only supported for security of single level sub-domains with the same host name. Without any limit Wildcard SSL can secure unlimited single level sub-domains.


6

There is no new version of sslstrip since 2011 and the feature is already there. How It works: First you need to know about the HSTS headers. SSLStrip will work when server sends HSTS header for the first time and you intercept the traffic in between don't allow the header to reach to the client. The important header field of HSTS that allows client to ...


0

The "grade" that you get from such tests is mostly meaningless. What kind of sense does it make to say that your server is "sort of" secure, but not completely ? Does it mean that attackers will still break in but won't be so smug about it ? The important point about SSL security, of security in general, is that it often is all-or-nothing: the attacker ...


4

A session id should be a Cookie parameter, and should never appear in the URL. Any value in the URL A will show up in the referer header, as well as access log files. A web application will end up transmitting authentication credentials to other websites, and storing them in plaintext on the filesystem. Additionally, when you pass a session id in the ...



Top 50 recent answers are included