If both client and server support TLS 1.1, the conversation will use TLS 1.1 and this attack will not work. This vulnerability demonstration will probably prompt websites such as PayPal to consider adding TLS 1.1 support.
If you host a website using IIS on Windows Server 2008 R2, you can enable TLS 1.1 server-side as an option for customers that have enabled it client side. That regkey is
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.1\Client] "DisabledByDefault"=dword:00000000
If both client and server support TLS 1.1, the conversation will use TLS 1.1 and this attack will not work. This vulnerability demonstration will probably prompt websites such as PayPal to consider adding TLS 1.1 support.
If you host a website using IIS on Windows Server 2008 R2, you can enable TLS 1.1 server-side as an option for customers that have enabled it client side. That regkey is
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.1\Server] "DisabledByDefault"=dword:00000000