JamieWeb · Report #323735
Insecure Transportation Security Protocol Supported (TLS 1.0) on https://www.jamieweb.net
Summary
TLS 1.0 was still enabled on my server. While there are currently no major vulnerabilities when using the latest software versions, it is good security practise to disable it.
I ran an Apache CustomLog in order to ensure I would not be breaking compatibility for a large number of visitors. Only 0.078% of requests out of around 100,000 were not using TLS 1.2, so I disabled TLS 1.0 and TLS 1.1 completely.
How it was found
Summary:
https://www.jamieweb.net still support TLS 1.0 protocol which has several flaws.
Vulnerability:
With a SSL security scanner i was able to identify that an insecure transportation security protocol (TLS 1.0) is still supported by your web server.
TLS 1.0 has several flaws. An attacker can cause connection failures and they can trigger the use of TLS 1.0 to exploit vulnerabilities like BEAST (Browser Exploit Against SSL/TLS).
Websites using TLS 1.0 will be considered non-compliant by PCI after 30 June 2018.
How to reproduice:
- Using Kali Linux, or any Linux distribution with nmap installed:
- Launch this command: nmap --script ssl-enum-ciphers -p 443 jamieweb.net
- Please check attached file for scan result: F270760 and see that there is still references to TLSv1.0.
Remedy:
Configure your web server to disallow using weak ciphers. Please note that you need to restart the web server to enable changes.
- For Apache, adjust the SSLProtocol directive provided by the mod_ssl module. This directive can be set either at the server level or in a virtual host configuration.
SSLProtocol +TLSv1.1 +TLSv1.2
- For Nginx, locate any use of the directive ssl_protocols in the nginx.conf file and remove TLSv1.
ssl_protocols TLSv1.1 TLSv1.2;
- For Microsoft IIS, you should make some changes on the system registry.
- Click on Start and then Run, type regedt32 or regedit, and then click OK.
- In Registry Editor, locate the following registry key or create if it does not exist:
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.0\
- Locate a key named Server or create if it doesn't exist.
- Under the Server key, locate a DWORD value named Enabled or create if it doesn't exist and set its value to "0".
Supporting Material/References:
- How to disable TLS v1.0
- OWASP - Insecure Configuration Management
- OWASP - Insufficient Transport Layer Protection
- How to disable PCT 1.0, SSL 2.0, SSL 3.0, or TLS 1.0 in Internet Information Services
- IIS Crypto is a free tool that gives administrators the ability to enable or disable protocols, ciphers, hashes and key exchange algorithms on Windows Server 2003, 2008 and 2012
- Date Change for Migrating from SSL and Early TLS
- Browser Exploit Against SSL/TLS Attack (BEAST)
Thanks for reading, Regards, retr0
Impact
Attackers can perform man-in-the-middle attacks and observe the encryption traffic between your website and its visitors.