HexBrain

Udemy · Report #217431

sweet32

Informativestatus
2upvotes
4 May 2017disclosed

How it was found

hello have found new attack against 3DES-CBC cipher in TLS,that they can decrypt customer data using a method called SWEET32 Birthday Attack. This Vulnerability has got CVE-2016-2183 and has cvss score 5.0 in atach you will see a print screen vuln confirmation by nmap script Mitigation for SWEET32 attack Prefer minimum 128-bit cipher suites Limit the length of TLS sessions with a 64-bit cipher, which could be done with TLS renegotiation or closing and starting a new connection Disable cipher suites using 3DES

This report was disclosed publicly on HackerOne and belongs to its author and the program. See the original