Re:Attack of the week: DUHK
by gcp on Tuesday October 24, 2017 @04:39AM
(#15540121)
Random (no pun intended) thought after reading this: how much of the supposedly secure HTTPS/TLS traffic is terminated by hardware load balancers and such that aren't really open and might have similar vulnerabilities?
[ Parent
| on HN ]
It's a huge chunk and it's an underappreciated problem.
Many appliance vendors have terrible self-made TLS stacks. There's a bunch of vendors whose names come up again and again when talking about stupid TLS bugs and vulnerabilities. Cisco, F5, Cavium, A10, Citrix, Fortinet are names that come to mind. And it's not only a problem for security, it's also a huge compatibility problem, as they tend to violate the protocol in ways that makes deploying new features and versions hard.
I've once given a talk where I tried to highlight this: https://www.youtube.com/watch?v=w3Sn5kMPzVA (slides unfortunately not in the video, but here https://int21.de/slides/auscert-tls/ )
Re:Attack of the week: DUHK
by philippnagel on Tuesday October 24, 2017 @08:48AM
(#15541132)
Are there any "solid" vendors?
I will make the opposite bet to sibling comment and say not too much. It's too easy to just install nginx and let it terminate connections to bother with a hardware device that you have to buy, store, and maintain.
And many sites use CDNs or cloud services for connection termination. Cloudflare and Amazon are surely on top of these things.
This is true of small shops and cloud operations but every enterprise IT shop I’ve seen has a router geek who is convinced you need an appliance to terminate traffic, even if it’s a decelerator in practice.
So we're hoping CloudFlare and Amazon don't have such bugs? (Ignoring the fact that it was already demonstrated at least once that they in fact do...)
Re:Attack of the week: DUHK
by marcosdumay on Tuesday October 24, 2017 @09:11AM
(#15541235)
People buy those devices for the throughput. Bigger sites are more likely to have them than smaller ones.