LinuxSecurity.com
Share your story
The central voice for Linux and Open Source security news
Home News Topics Advisories HOWTOs Features Newsletters About Register

Welcome!
Sign up!
EnGarde Community
Login
Polls
What is the most important Linux security technology?
 
Advisories
Community
Linux Events
Linux User Groups
Link to Us
Security Center
Book Reviews
Security Dictionary
Security Tips
SELinux
White Papers
Featured Blogs
All About Linux
DanWalsh LiveJournal
Securitydistro
Latest Newsletters
Linux Advisory Watch: December 19th, 2014
Linux Advisory Watch: December 12th, 2014
Subscribe
LinuxSecurity Newsletters
E-mail:
Choose Lists:
About our Newsletters
RSS Feeds
Get the LinuxSecurity news you want faster with RSS
Powered By

  
Most SSL Sites Poorly Configured Print E-mail
User Rating:      How can I rate this item?
Source: Dark Reading - Posted by Alex   
Latest News The good news about SSL-based websites: Most are running strong encryption. The bad news: More than 60 percent aren't properly configured. Researcher Ivan Ristic, who is director of engineering, Web application firewall, and SSL at Qualys, revealed findings here yesterday from a study he conducted of some 120 million registered domain names. Ristic found that 20 million of them support SSL, but only 720,000 of these have potentially valid SSL certificates. "That's a very small percentage, but it doesn't really mean anything apart from that a fraction of sites use SSL, which we've known," Ristic say.

Of the more telling findings was that of all the SSL sites, half use SSLv2, an older version of SSL, which is known to be insecure. Only 38 percent of all SSL sites are actually configured well, Ristic says, and 32 percent contain a previously exposed renegotiation vulnerability in the protocol.

Meanwhile, researchers Robert "RSnake" Hansen and Josh Sokol here yesterday detailed some 24 exploitation techniques possible against HTTPS/SSL for browsers that leverage man-in-the-middle (MITM) attacks. Among them: cookie poisoning and injecting malicious content into browser tabs. The researchers warned that HTTPS can't guarantee confidentiality and integrity in the browser.

Read this full article at Dark Reading

Only registered users can write comments.
Please login or register.

Powered by AkoComment!

 
< Prev   Next >
    
Partner

 

Latest Features
Peter Smith Releases Linux Network Security Online
Securing a Linux Web Server
Password guessing with Medusa 2.0
Password guessing as an attack vector
Squid and Digest Authentication
Squid and Basic Authentication
Demystifying the Chinese Hacking Industry: Earning 6 Million a Night
Free Online security course (LearnSIA) - A Call for Help
What You Need to Know About Linux Rootkits
Review: A Practical Guide to Fedora and Red Hat Enterprise Linux - Fifth Edition
Weekend Edition
Report: U.S. planning “proportional response” to Sony hack, blamed on North Korea
Heartbleed, Shellshock, Tor and more: The 13 biggest security stories of 2014
Partner Sponsor

Community | HOWTOs | Blogs | Features | Book Reviews | Networking
 Security Projects |  Latest News |  Newsletters |  SELinux |  Privacy |  Home
 Hardening |   About Us |   Advertise |   Legal Notice |   RSS |   Guardian Digital
(c)Copyright 2014 Guardian Digital, Inc. All rights reserved.