), which employ TLS data compression.
In a CRIME attack, the attacker recovers the content of secret authentication cookies and uses this information to hijack an authenticated web session. The attacker uses a combination of plaintext injection and TLS compression data leakage to exploit the vulnerability. The attacker lures the Web browser to make several connections to the website. The attacker than compares the size of the ciphertexts sent by the browser during each exchange to determine parts of the encrypted communication and hijack the session.
If you are vulnerable to the CRIME attack, the highest grade you can receive is a C.
Modify gzip to allow for explicit separation of compression contexts in SPDY.
"The server could allow client connections that are vulnerable to the FREAK attack."
During the 90s, the U.S. government set up rules for the export of encryption systems. These rules limited the strength of the RSA encryption keys to a maximum 512 bits in any Secure Socket Layer (SSL) implementations targeted for export. Eventually the rules changed. The "export" cipher suites stopped being used, and by the year 2000, browsers were able to use a higher security SSL.
A team of researchers revealed that the old export-grade cryptographic suites are still being used today. Servers that support RSA export cipher suites could allow a man-in-the-middle (MITM) to trick clients, who support the weak cipher suites, into using these weak 40- and/or 56-bit export cipher suites to downgrade their connection. The MITM can then use today's computing power to crack those keys in just a few hours.
The FREAK attack is possible because some servers, browsers, and other SSL implementations still support and use the weaker export-grade cryptographic suites, which lets a MITM force these clients to use export-grade keys even if they didn't ask for export-grade encryption. Once the encryption of the session is cracked, the MITM can steal any'secured' personal information from the session.
The server must support RSA export cipher suites.
The client must do one of the following: (1) must offer an RSA export suite, or (2) must be using Apple SecureTransport, or (3) must be using a vulnerable version of OpenSSL, or (4) must be using Secure Channel (Schannel).
Export-grade cryptographic suites were discovered in OpenSSL and Apple’s Secure Transport (used in Chrome, Safari, Opera, and the Android and the BlackBerry stock browsers), as well as Windows Secure Channel/Schannel (a cryptographic library included in all supported versions of Windows and used in Internet Explorer).
If your server supports any of the weak 40- and/or 56-bit encryption cipher suites listed below, the highest grade that you can receive is an F.
Disable support for all export-grade cipher suites on your servers. We also recommend that you disable support for all known insecure ciphers (not just RSA export ciphers), disable support for ciphers with 40- and 56-bit encryption, and enable forward secrecy.
FREAK vulnerability patched in latest OpenSSL Release.
See Mozilla's recommended configurations and Mozilla's SSL Configuration Generator.
See Microsoft's Security Advisory 3046015.
Vulnerable clients include software that rely on OpenSSL or Apple's Secure Transport (i.e., Chrome, Safari, Opera, the Android and the BlackBerry stock browsers), or Windows Secure Channel/Schannel (i.e. Internet Explorer).
To test your browser, use this Client Test.
OS distributors should be releasing patches for their browsers shortly. See Tracking the FREAK Attack for patch/update statuses.
"This server is vulnerable to the Heartbleed Bug attack."
OpenSSL is an open-source toolkit that implements the Secure Sockets Layer (SSL) and Transport Security Layer Security (TLS) protocols, including a cryptographic library that employs cryptographic functions and supplies different utility functions. This cryptographic library is commonly implemented by servers on the Internet to secure much of the Internet's traffic.
The cryptographic libraries in OpenSSL versions 1.0.1 through 1.0.1f and 1.0.2-beta1 are vulnerable to the Heartbleed Bug attack. The Heartbleed Bug vulnerability is a weakness in the OpenSSL cryptographic library, which allows an attacker to gain access to sensitive information that is normally protected by the SSL and TLS protocols.
The attacker can use these keys to decrypt past and future secure communications to your website and to impersonate your website at any time.
The attacker can use your customers’ user names and passwords to access their information that is secured by your website.
The attacker can access personal or financial details, private communications (email or instant messages), and documents.
The attacker can access leaked memory content, such as memory address and security measures.
If you are vulnerable to the Heartbleed Bug attack, the highest grade you can receive is an F.
When securing your environment against the Heartbleed Bug, you need to patch OpenSSL on servers that are running vulnerable versions of OpenSSL, and you need to patch software that is using affected versions of the OpenSSL library.
Check your package manager for an updated OpenSSL package and install it. If you do not have an updated OpenSSL package, obtain the latest version of OpenSSL from your Service Provider.
Note: You may need to restart your software after it is patched to make sure the OpenSSL library is reset and that the Heartbleed Bug is removed from cached memory.
Recompile OpenSSL with the OPENSSL_NO_HEARTBEATS flag.
Rekey, reissue, and install certificates.
Then, after servers and software are patched, and only after they are patched, install your reissued certificates.
After installing reissued certificates, you need to revoke the certificates that were replaced. To get your certificates revoked, contact your Certificate Authority.
To have your certificate revoked, email support at support@digicert.com and make sure to include your certificate's order number and a brief description of what you want revoked.
"The server is configured to allow client-initiated insecure TLS renegotiation."
The Secure Socket Layer (SSL)/Transport Layer Security (TLS) protocol contains a session renegotiation feature that permits a server and client to use their connection to establish new parameters and generate new keys during the session.
Renegotiation is not directly associated with the channel. Not being associated with a channel creates a vulnerability that is susceptible to a man-in-the-middle attack. The TLS Renegotiation Man-In-The-Middle attack initiates a renegotiation between the man-in-the-middle and the server. Meanwhile, the client continues operations assuming that the connection is still in the negotiation phase.
If you are using insecure TLS renegotiations, the highest grade you can receive is an F.
Make sure your servers support secure negotiations by running current versions of the SSL/TLS protocol. Servers should not be running SSL 2.0, an outdated version of SSL that has known vulnerabilities.
Because it is impossible for the Web browser to know if a given server is running an obsolete version of the SSL/TLS protocol, you could also disable renegotiations.
"The server could allow client connections that are vulnerable to the Logjam attack."
The server must support DHE_EXPORT cipher suites.
The client must support a DHE_EXPORT suite.
If your server supports any DHE_EXPORT cipher suites, the highest grade that you can receive is an F.
Generate a strong Diffie-Hellman Parameter, minimum 2048-bits.
You can use OpenSSL to generate your new Diffie-Hellman parameter.
Vulnerable clients include Internet Explorer, Chrome, Safari, and Mozilla.
Update browsers to the most recent version (post 05/20/2015).
*Note: As part of the research team's disclosure, they created a comprehensive guide to mitigate this vulnerability for both Servers and Clients. See Guide to Deploying Diffie-Hellman for TLS.
RC4 is a stream cipher that was designed by Ron Rivest in 1987. The main benefits of RC4 that have made it so popular are its simplicity and speed.
The BEAST attack was discovered in 2011. The solution to mitigating the attack is to enable TLS 1.1 and TLS 1.2 on servers and in browsers. For those who could not enable TLS 1.1 and TLS 1.2, a workaround is provided: Configure SSL to prioritize RC4 ciphers over block-based ciphers. This workaround doesn’t eliminate exposure to the BEAST attack but does “limit” exposure to the BEAST attack.
Because RC4 is easy to implement and because of the BEAST attack workaround, the RC4 stream cipher’s use is widespread. One estimate says that RC4 may account for up to 50% of all TLS traffic.
A group of researchers discovered a new attack against TLS which would allow an attacker to use a browser to make numerous connections while watching and recording the traffic of said connections. As of 2014, the attack is only theoretical, but given time it may soon become practical.
If you have a cipher suite enabled that is using the RC4 stream cipher, the highest grade you can receive is a B.
Enable TLS 1.2 on servers that support TLS 1.2 and switch to AEAD cipher suites (i.e. AES-GCM).
Enable TLS 1.2 in browsers that support TLS 1.2.
Disable all RC4-based cipher suites in your server’s SSL configuration.
Note: Only use this workaround if you cannot enable TLS 1.2 on servers and in Web browsers.
"SSL 2