How can I test if my own, Heroku-based servers are affected?
The Freak Attack SSL/TLS Vulnerability
11–20 of 120 posts
Re: The Freak Attack SSL/TLS Vulnerability
#12I can't believe that they are outright naming vulnerable sites, that is really classless. Even if the data could be gathered by an attacker now that a vulnerability is known, you don't need to go the extra mile to provide it.
How vulnerable is accessing these sites? If I tracert to them, the few that I have tried go from the isp to high tier transit to a cloud hosting company. Doesn't seem like much in the way of attack vector beyond someone with a court order access to servers along the route.
Re: The Freak Attack SSL/TLS Vulnerability
#13This is a very disappointing trend in security. Publicly shaming sites into action is not a benefit that outweighs making it easier for attackers. It's ridiculous to argue that it is.
I disagree with this perspective entirely. There are many more users of these sites than operators. Assume that a site is no longer secure, therefore operating any of these sites and claiming secure comms is fraudulent. This fraud is obviously unintentional of course, but the greater damage is to the user, not the site.
Secondly, it saves attackers a trivial amount of time. If they're able to exploit this problem, scanning for its existence is orders of magnitude easier.
Re: The Freak Attack SSL/TLS Vulnerability
#14This is a very disappointing trend in security. Publicly shaming sites into action is not a benefit that outweighs making it easier for attackers. It's ridiculous to argue that it is.
Running zmap or masscan is such a low barrier to entry (compared to the expertise required to then factor the key and set up a MitM attack) that it's hard to argue this is really making it that much easier for attackers.
Aside from the benefit of pressuring these sites into fixing the problem, it also benefits users, who can now make an informed choice about whether to (say) visit a vulnerable site at a cafe or wait until they get home.
Re: The Freak Attack SSL/TLS Vulnerability
#15I can't believe that they are outright naming vulnerable sites, that is really classless. Even if the data could be gathered by an attacker now that a vulnerability is known, you don't need to go the extra mile to provide it.
Export cipher suites have been known to be weak for years.
They have been known to be weak literally since their inception. The entire reason for export cipher suites was to create encryption that could be broken by the US government.
No one should have permitted them since the export control was lifted in 2000.
That does not change the fact that some sites did in fact continue to permit them as 'last resort' ciphersuites, to ensure total browser coverage. This did not compromise site security for users who supported actually secure ciphersuites -- until now.
Responsible disclosure should mean that impacted sites (if they have been identified) should be informed before being publicly shamed. Doesn't matter if they were doing something dumb, it wasn't a known security vulnerability before now.
Re: The Freak Attack SSL/TLS Vulnerability
#16That page has a meta description for different vulnerability:
Re: The Freak Attack SSL/TLS Vulnerability
#17Checked Google Chrome prior to update, said it was vulnerable. Updated and now it isn't. Firefox 37 on OS X wasn't vulnerable apparently.
Re: The Freak Attack SSL/TLS Vulnerability
#18https://freakattack.com/clienttest.html I just tested my devices. Linux machines running firefox all passed. On the other hand my Android phone did not, lots of RSA_EXPORT ciphers accepted. But as with nearly every security story: linux/foss software for the WIN!
Oddly, I've seen different results on subsequent visits to their site with the same browser (Chrome 40).
Re: The Freak Attack SSL/TLS Vulnerability
#19This is a very disappointing trend in security. Publicly shaming sites into action is not a benefit that outweighs making it easier for attackers. It's ridiculous to argue that it is.
Running zmap or masscan is such a low barrier to entry (compared to the expertise required to then factor the key and set up a MitM attack) that it's hard to argue this is really making it that much easier for attackers. Aside from the benefit of pressuring these sites into fixing the problem, it also benefits users, who can now make an informed choice about whether to (say) visit a vulnerable site at a cafe or wait…
I want to disagree with you, but you're right. If there is any reason to call into question the trust or safety of a site I visit, I should know.
Re: The Freak Attack SSL/TLS Vulnerability
#20This is a very disappointing trend in security. Publicly shaming sites into action is not a benefit that outweighs making it easier for attackers. It's ridiculous to argue that it is.
I disagree with this perspective entirely. There are many more users of these sites than operators. Assume that a site is no longer secure, therefore operating any of these sites and claiming secure comms is fraudulent. This fraud is obviously unintentional of course, but the greater damage is to the user, not the site. Secondly, it saves attackers a trivial amount of time. If they're able to exploit this problem, sc…
Do you know if they are only scanning or reporting the 'www' sites or are they listing the main site even if it's just a single server misconfigured, or subdomain, etc?