APACHE的SSL增强认证设置(BEAST)，满足于PCI Compliance-阿里云开发者社区

APACHE的SSL增强认证设置(BEAST)，满足于PCI Compliance

2016-05-11 1775

版权

本文内容由阿里云实名注册用户自发贡献，版权归原作者所有，阿里云开发者社区不拥有其著作权，亦不承担相应法律责任。具体规则请查看《阿里云开发者社区用户服务协议》和《阿里云开发者社区知识产权保护指引》。如果您发现本社区中有涉嫌抄袭的内容，填写侵权投诉表单进行举报，一经查实，本社区将立刻删除涉嫌侵权内容。

简介：

公司作PCI Compliance时，涉及一系列安全改进。

我就SSL的BEAST攻击作了安全增强，只允许RC4级的安全认证协议，而非常规默认的CBC MODE。

~~~~~~~~~~

简介如下：

Approximately one year ago Juliano Rizzo and Thai Duong (the so-called BEASTie Boys) discovered a way to break SSL Encryption by mean of their BEAST attack (Browser Exploit Against SSL/TLS).

Their attack exploited a design flaw of the SSL/TLS 1.0 protocols (or better of the CBC cipher-suites, such as AES and 3DES), allowing to decrypt an encrypted conversation by sniffing the traffic and injecting a known pattern in the encryption channel. At that time the research had a considerable impact, given the wide usage of SSL/TLS in millions of websites providing secure online services.

As TLS 1.2 was not vulnerable, it was told, when possible, to migrate to this version of the protocol, but since its adoption is still far from being common, it was suggested, as Google did, to use a cipher not involving CBC mode, as for instance RC4.

After one year, at the Ekoparty Conference in Argentina, the two researchers are going to unveil a new attack against SSL/TLS dubbed CRIME. Few details are currently available: the two researchers are not revealing exactly which feature of SSL/TLS is responsible for the CRIME Attack (except that the specific feature used in this attack has not been a major subject of security research until now). In any case the new attack works much like the BEAST attack: once they have a man-in-the-middle position on a given network, they can sniff HTTPS traffic and launch the attack.

The bad news is that all versions of TLS (including 1.2) are vulnerable, and is not dependant on the cipher-suite adopted. Furthermore, according to the few information available, the exploits uses JavaScript code to make the attack faster, but in theory it could work also with static HTML, by loading JavaScript into the victim’s browser from a separate site.

The good news is that, although both Mozilla Firefox and Google Chrome are vulnerable to the attack. the browser vendors have developed patches for the issue that will be released in the next few weeks.