Major Security Holes

ChopinX

Update SSL 2.0 to SSL 3.0, as it is a major security hole. Also:

-SSL weak cyphers
-DNS cache snooping

neg

yeah

ifonly

Fuck off

ChopinX

This wasn't directed towards the players here - I hope BCart is paying attention as he said he would, or it will be exploited.

neg

pm him as well

ChopinX

Weak SSL ciphers (SSL2 on port 443):

SSL2_CK_RC4_128_EXPORT40_WITH_MD5 - Low strength
SSL2_CK_RC2_128_CBC_EXPORT40_WITH_MD5 - Low strength
SSL2_CK_DES_64_CBC_WITH_MD5 - Low strength

The DNS server is running on UDP port 53.


The SSL server (port: 443) encrypts traffic using an old deprecated protocol (SSL 2.0) with known weaknesses.

Stone

I don't know what any of this means, but it disturbs and upsets me greatly

Scientology

@bcartfall

Scientology

nerds

Glaven.

Natso

edit: ----
edit: ----
edit: screw this.

dank

I don't know what any of this means, but it disturbs and upsets me greatly

It means that BCart doesn't care about us.

Stone

Ahhhh I should have just guessed that, thanks for the translation dank

Qwjvfiil

Does it really matter? we had NO ssl before so it cant be any less secure than then :-))

Lynog_LFC_x2ndCx

i think its just that nonce jayr pretending to be clever

dank

Does it really matter? we had NO ssl before so it cant be any less secure than then :-))

Yes, it does matter, and not using it would be far more secure. They created a new version to solve existing issues. The problem here is that it's mostly a man in the middle attack that will effect users. We witnessed a major attack on this server that led to this insanely God awful forum being put up. All BCart has to do is change a single setting on his web host.

Here are a few quick snippets regarding SSL 2.0:

"There are no reasons to use SSL 2.0 now as it has several serious known security weaknesses that SSL 3.0 and TLS 1.0 fixes. And SSL 3.0 has been out since 1996, so the chance that there are any old web servers out there not supporting SSL 3.0 are minimal."

"SSL 2 has no pros and should not be used. That's precisely why it's off by default in every modern SSL application (unless you use GoDaddy - dank comment). Do not turn it on unless you know why you're turning it on. If you have to ask why you would turn it on, you do not have a reason to do so."

Message integrity compromised. The SSLv2 message authentication uses the MD5 function, and is insecure.

Man-in-the-middle attack. There is no protection of the handshake in SSLv2, which permits a man-in-the-middle attack.

Truncation attack. SSLv2 relies on TCP FIN to close the session, so the attacker can forge a TCP FIN, and the peer cannot tell if it was a legitimate end of data or not.

Weak message integrity for export ciphers. The cryptographic keys in SSLv2 are used for both message authentication and encryption, so if weak encryption schemes are negotiated (say 40-bit keys) the message authentication code use the same weak key, which isn't necessary.