90% of All SSL VPNs are Insecure

Security firm High-Tech Bridge has conducted a statistical study that indicates 90% of all SSL-based VPNs in the world use insecure or outdated encryption. The study scanned 10,436 randomly selected, publicly accessible VPN servers taken from a scope of 4 million randomly selected IPv4 addresses. The results shows the following issues:

• 77% of the SSL VPNs still use the insecure SSLv3 or the even less secure SSLv2
• 76% use an untrusted SSL certificate
• 74% have an insecure SHA-1 signature
• 41% use an insecure key length of 1024 for RSA certificates
• 10% rely on versions of SSL that are still vulnerable to the Heartbleed attack

According to the study, only 3% of the sites were compliant with Payment Card Industry Data Security Standard (PCI DSS) requirements, and none were compliant with the US National Institute of Standards and Technology (NIST) guidelines.

The sobering study indicates that, after so many security alerts and news posts, organizations around the world are still not fully aware of the problems associated with older versions of SSL. See the blog post at the High-Tech Bridge site https://www.htbridge.com/blog/90-percent-of-ssl-vpns-use-insecure-or-outdated-encryption.html for more information, and definitely upgrade your SSL/TLS service and spend some time with your VPN implementation to make sure the service is up to date.

Dangerous New Attack Could Compromise One Third of All HTTPS Servers

A team of security researchers has uncovered a high-severity new attack that could make up to one third of all HTTPS web traffic vulnerable to compromise. The cross-protocol DROWN attack (CVE-2016-0800) exploits flaws in the SSLv2 protocol. The attacker must passively observe around 1,000 TLS handshakes and initiate roughly 40,000 probe connections, performing computations offline to complete the attack. Running the computations on Amazon EC2 costs around $440.

The report indicates that 25% of the top 1 million domains, and 33% of all HTTPS sites, are vulnerable to the DROWN attack. The attack is focused on server systems, which typically manage the HTTPS process. The researchers add, "There is nothing practical that browsers or end-users can do on their own to protect against this attack."

The team that discovered DROWN has gone to considerable trouble to make information available to users. A website that went live at the moment of public disclosure includes a testing tool to check whether your systems are vulnerable.

Users are encouraged to disable SSLv2 "… in all SSL/TLS servers if you haven't done so already." Disabling SSLv2 ciphers without disabling the protocol is not sufficient, unless you have updated your systems with the patches for an earlier SSL problem (CVE 2015-3197), because an attack could force SSLv2 if it is present on the system.

The team also cautions not to share private keys among servers. According to the DROWN website, "Many companies reuse the same certificate and key on their web and email servers, for instance. In this case, if the email server supports SSLv2 and the web server does not, an attacker can take advantage of the email server to break TLS connections to the web server." See the technical paper for additional information on the attack https://drownattack.com/drown-attack-paper.pdf.

Linux Backdoor Doesn't Need Root Privileges

Researchers have discovered a new backdoor called Fysbis that is aimed at Linux machines. The new malware has extremely sophisticated properties, and experts suspect it might have come from the APT 28 cyber-espionage group, which reportedly has ties with Russia.

One insidious quality of Fysbis is that it doesn't require root access to start working for the attacker. The malware is apparently able to enter the system at a lesser security level and begin reconnaissance, performing tests and sending information back to a remote command and control center with clues for how to escalate privileges. According to a report at TechWorm http://www.techworm.net/2016/02/russian-hackers-spying-linux-pc-sophisticated-malware-fysbis.html, Fysbis can "… open a remote shell on the infected machine, run commands on the attacker's behalf, find, read, save, execute, or delete files, and log keyboard input."

Major Bug in glibc Could Result in System Compromise

Google's Security team has reported a problem with the popular glibc library found in most Linux systems that could result in a serious security breach. The problem affects glibc version 2.9 and later. Specifically, the glibc client-side DNS resolver is vulnerable to a buffer overflow attack that could cause the system to access an attacker-controlled website or DNS server. The post in the Google security blog reports that the glibc team was first alerted to the bug in July 2015 and that Red Hat has also been working on a fix for this problem. The best remedy is to update your systems and install the patch for CVE-2015-7547 as soon as possible.

If you are not immediately able to patch glibc, Google recommends you "… limit the response sizes (i.e., via DNSMasq or similar programs) accepted by the DNS resolver locally as well as ensure that DNS queries are sent only to DNS servers that limit the response size for UDP responses with the truncation bit set."