90% of All SSL VPNs are Insecure
Security firm High-Tech Bridge has conducted a statistical study that indicates 90% of all SSL-based VPNs in the world use insecure or outdated encryption. The study scanned 10,436 randomly selected, publicly accessible VPN servers taken from a scope of 4 million randomly selected IPv4 addresses. The results show the following issues:
- 77% of the SSL VPNs still use the insecure SSLv3 or the even less secure SSLv2
- 76% use an untrusted SSL certificate
- 74% have an insecure SHA-1 signature
- 41% use an insecure key length of 1024 for RSA certificates
- 10% rely on versions of SSL that are still vulnerable to the Heartbleed attack
According to the study, only 3% of the sites were compliant with Payment Card Industry Data Security Standard (PCI DSS) requirements, and none were compliant with the US National Institute of Standards and Technology (NIST) guidelines.
The sobering study indicates that, after so many security alerts and news posts, organizations around the world are still not fully aware of the problems associated with older versions of SSL. See the blog post at the High-Tech Bridge site for more information, and definitely upgrade your SSL/TLS service and spend some time with your VPN implementation to make sure the service is up to date.
Related content
-
News for Admins
News for system administrators around the world. -
SSL/TLS best practices for websites
SSL and TLS are very complex technologies. If you want to avoid wading through cryptography manuals to harden your HTTPS web server, read on for practical recommendations on establishing, securing, and optimizing your SSL/TLS configuration. -
SHA-3 – The New Hash Standard
NIST has chosen the Keccak algorithm as the new cryptographic hash standard, but in real life, many users are still waiting to move to its predecessor, SHA-2.
- Router distribution Vyatta is now certified for IPv6
-
SHA-3 – The new hash standard
NIST has chosen the Keccak algorithm as the new cryptographic hash standard but, in real life, many users are still waiting to move to its predecessor SHA-2.