Unsolved
This post is more than 5 years old
5 Journeyman
•
15.6K Posts
•
45K Points
0
6556
September 23rd, 2011 18:00
Secure web browsing cracked by "BEAST"
"A pair of researchers have unveiled a serious new attack on web browser security... a new tool [called "BEAST"] that attacks TLS and SSL, the cryptographic protocols used to establish secure web connections.
The ability to crack encrypted web traffic removes the safety net that protects you when you're doing sensitive online tasks like banking or using credit cards...
Right now the attack can take up to half an hour to execute."
Full article (by Mark Stockley) http://nakedsecurity.sophos.com/2011/09/24/secure-web-browsing-cracked-by-beast/?utm_source=facebook&utm_medium=status+message&utm_campaign=naked+security
-----------------
Addendum [from http://en.wikipedia.org/wiki/Transport_Layer_Security#Browser_implementations ]
Mozilla Firefox, versions 2 and above, support TLS 1.0 [the protocol now under attack]. As of September 2011, Firefox does not support TLS 1.1 or 1.2.
Internet Explorer 8 in Windows 7 (and Windows Server 2008 R2) supports [the newer/safe] TLS 1.2. [It seems that IE8 under Win XP only supports TLS 1.0]
As of Presto 2.2, featured in Opera 10, Opera supports TLS 1.2.
0 events found
ky331
5 Journeyman
•
15.6K Posts
•
45K Points
0
September 28th, 2011 05:00
Microsoft has issued an advisory, including some work-arounds for Windows 7 (and for Vista):
http://technet.microsoft.com/en-us/security/advisory/2588513
ky331
5 Journeyman
•
15.6K Posts
•
45K Points
0
September 30th, 2011 15:00
By my reading of the Microsoft Advisory, the two Microsoft FixIts (that enable TLS 1.1) are applicable only to Windows 7 or Windows Server 2008 R2.
And the other "work-around", using RC4 encryption, might be applicable on Vista (can someone confirm this???), but NOT on XP.
========================================
.
"Yet another good reason to dump Java if you don't need it". --- Works for me! :emotion-2: I was just mentioning this in your other thread...
ky331
5 Journeyman
•
15.6K Posts
•
45K Points
0
October 19th, 2011 10:00
Oracle has now released Java updates (v6 u29 , v7 u1) which address Java's role in this vulnerability.
(I don't believe that means that the issue has been fixed for browser's "in general"... just that the "java factor" therein has been corrected.)