If you want to check your domains/servers, not just your clients I updated a cipher verification script to just test Export (EXP) ciphers via openssl: https://gist.github.com/degan/70e8059507d173751294
The Freak Attack SSL/TLS Vulnerability
41–50 of 120 posts
Re: The Freak Attack SSL/TLS Vulnerability
#42OpenSSL has way too many options that reduce security. A lot of that legacy code needs to be removed outright. Not turned off by some flag, not controlled by some environment variable, removed.
(And then, when Rust settles down, OpenSSL needs to be rewritten in Rust, as cleanly as possible.)
Re: The Freak Attack SSL/TLS Vulnerability
#43We wrote a blog post: The perfect SSL nginx configuration ( http://blog.commando.io/the-perfect-nginx-ssl-configuration/ ) which details all the nginx directives to set to achieve an A+ rating on sslLabs, including mitigation of FREAK, POODLE, and HEARTBLEED.
Some other useful resources:
https://wiki.mozilla.org/Security/Server_Side_TLS
https://mozilla.github.io/server-side-tls/ssl-config-generat...
Re: The Freak Attack SSL/TLS Vulnerability
#44freakattack.com is an IP owned and managed by the University of Michigan. I could not visit the site due to them being in my firewall's ban list caused by unauthorized vulnerability testing against my home network.
As an aside I wonder why our tax dollars are being used to support unauthorized vulnerability attempts and for hosting a .com commercial site?
Is it legal for the person/people operating freakattack.com to use US Tax Income to fund their own commercial efforts using University resources? I didn't graduate college, maybe it's legal for them to do this?
Re: The Freak Attack SSL/TLS Vulnerability
#45If you want to check your domains/servers, not just your clients I updated a cipher verification script to just test Export (EXP) ciphers via openssl: https://gist.github.com/degan/70e8059507d173751294
Could do with making your messages a bit more clear, i.e: does No mean not vulnerable or does Yes mean not vulnerable.
Re: The Freak Attack SSL/TLS Vulnerability
#46Earlier quoted context omitted.
I disagree. If seeing their name on this list lights a fire under them to fix it that much faster, this is a good thing. Besides, if the you are an attacker capable of exploiting this vulnerability in the wild, this is the first and easiest part of the process. Scanning the top 1M sites would take you no time at all. Edit: what really is annoying is that the sysadmin guide is "Coming Soon!". That is the irresponsible…
I really disagree with your perspective here, but I do concur that a fast fix is desirable for any impacted site. Notifying impacted sites ahead of public disclosure would have been a better move, and particularly ahead of public shaming and attacker targeting. While these notifications may have gone out, there is no reference to any such thing on the page. Also: do they plan to update this list? Or are these sites t…
> Notifying impacted sites ahead of public disclosure would have been a better move
Notifying that many effected websites is practically the same as making it public, and could've resulted in letting attackers know about this before the public (and any effected websites that aren't on your list) knows about it and is able to fix that.
Re: The Freak Attack SSL/TLS Vulnerability
#47So this isn't just a thing where I update openssl? I have to learn about configuring cyphers on short notice?
Re: The Freak Attack SSL/TLS Vulnerability
#48I can't believe that they are outright naming vulnerable sites, that is really classless. Even if the data could be gathered by an attacker now that a vulnerability is known, you don't need to go the extra mile to provide it.
They're listing sites out of the top alexa rankings.
Anyone can do this scan themselves in minutes.
It's not a mile, it's a tiny hop and enough simpler than writing exploit code that it's negligible.
Re: The Freak Attack SSL/TLS Vulnerability
#49freakattack.com is an IP owned and managed by the University of Michigan. I could not visit the site due to them being in my firewall's ban list caused by unauthorized vulnerability testing against my home network. As an aside I wonder why our tax dollars are being used to support unauthorized vulnerability attempts and for hosting a .com commercial site? Is it legal for the person/people operating freakattack.com to…
> support unauthorized vulnerability attempts
That was probably just a random student who learned some fun stuff in Security class and slept through the Ethics lesson. I can't speak for UMich, but security research at my university (NC State) has a very strict "don't attack civilians" policy.
> hosting a .com commercial site
First off, .com sites are not necessarily commercial. Second, this isn't a commercial site, it's an informational page about a recently discovered TLS vulnerability.
Re: The Freak Attack SSL/TLS Vulnerability
#50If you want to check your domains/servers, not just your clients I updated a cipher verification script to just test Export (EXP) ciphers via openssl: https://gist.github.com/degan/70e8059507d173751294
Could do with making your messages a bit more clear, i.e: does No mean not vulnerable or does Yes mean not vulnerable.
Yep, I used it and I have no idea whatsoever whether my server is vulnerable or not. Similar for the ssllabs.com test.