Re:Attack of the week: DUHK
by hannob on Tuesday October 24, 2017 @05:10AM
(#15540250)
It's a huge chunk and it's an underappreciated problem.
Many appliance vendors have terrible self-made TLS stacks. There's a bunch of vendors whose names come up again and again when talking about stupid TLS bugs and vulnerabilities. Cisco, F5, Cavium, A10, Citrix, Fortinet are names that come to mind. And it's not only a problem for security, it's also a huge compatibility problem, as they tend to violate the protocol in ways that makes deploying new features and versions hard.
Many appliance vendors have terrible self-made TLS stacks. There's a bunch of vendors whose names come up again and again when talking about stupid TLS bugs and vulnerabilities. Cisco, F5, Cavium, A10, Citrix, Fortinet are names that come to mind. And it's not only a problem for security, it's also a huge compatibility problem, as they tend to violate the protocol in ways that makes deploying new features and versions hard.
I've once given a talk where I tried to highlight this: https://www.youtube.com/watch?v=w3Sn5kMPzVA (slides unfortunately not in the video, but here https://int21.de/slides/auscert-tls/ )