Disable Weak Ciphers in Web Service

xcentric · Post by **xcentric** » Tue Dec 18, 2012 10:21 am

Alex,

A recent scan targeted at the web service revealed the following weak ciphers. Is there a way to disable these?

SSLv3
TLS_RSA_WITH_DES_CBC_SHA - weak
TLS_RSA_WITH_IDEA_CBC_SHA - weak

TLSv1
TLS_RSA_WITH_DES_CBC_SHA - weak
TLS_RSA_WITH_IDEA_CBC_SHA - weak

Regards

KS-Soft · Post by **KS-Soft** » Tue Dec 18, 2012 11:57 am

Probably we can add option... but is it necessary?
WebService does not provide full access to system anyway, it does not have access to test settings, passwords, etc, it just shows statistics.

Regards
Alex

xcentric · Post by **xcentric** » Tue Dec 18, 2012 4:01 pm

We are dealing with more respectable high profile clients and do not want to give them any room to question our security practices or conduct surprize audits on our services.

Aside from weak ciphers the web service reports other vulnerabilities we would like to see addressed.

https://www.ssllabs.com/ssltest/analyze ... Results=on

Regards

KS-Soft · Post by **KS-Soft** » Wed Dec 19, 2012 6:00 am

Ok, we will add couple more options.

Aside from weak ciphers the web service reports other vulnerabilities we would like to see addressed.
https://www.ssllabs.com/ssltest/analyze ... Results=on

"see addressed"? Like option to disble SSL v2.0 and renegotiation?

Regards
Alex

xcentric · Post by **xcentric** » Wed Dec 19, 2012 9:08 am

Correct.

1. Disable SSL v2.
2. Disable client initiated renegotiation.
3. Disable insecure renegotiation.
4. Prioritize RC4 to mitigate the BEAST attack. Practical mitigation requires that servers speak only RC4 when using TLS v1.0 or SSL v3.

With these options added any type of audit should pass.

Regards

xcentric · Post by **xcentric** » Mon Dec 31, 2012 11:27 am

Hi Alex,

I appreciate you including this request within the 9.38 update.
However, I am unable to get it working.

1. I ugraded the installation using the installer.
2. Aded the changes to the misc secion of the webservice.ini
3. Restarted webservice.
4. Audi results in no changes made.

Please advise.

[Misc]
DisableDES=1
Disable3DES=1
DisableIDEA=1
DisableMD5=1
DisableSSLv2=1
DisableExport40=1

KS-Soft · Post by **KS-Soft** » Mon Dec 31, 2012 11:50 am

Could you check version of Web Service or file size?

Regards
Alex

KS-Soft Europe · Post by **KS-Soft Europe** » Mon Dec 31, 2012 12:52 pm

Please, use [SSL] section of webservice.ini instead of [Misc].
Do not forget to restert Web Service after making changes.

xcentric · Post by **xcentric** » Mon Dec 31, 2012 1:43 pm

Using the ssl section was the answer.
The release notes read to use the misc section instead.

Some observations.
1. While there are no ciphers enabled for sslv2, it is still enabled.
2. Disabling ciphers and prioritizing rc4 on top is a start however the other vulnerabilities still exist such as non secure and client initiated renegotiation.
3. Even though rc4 sha is on top, the beast vulnerability still exists.

Regards