Three Windows Server SSL/TLS security vulnerabilities and their remedy

Three Windows Server SSL/TLS security vulnerabilities and their remedy

Not long ago, the simple use of SSL on Windows servers, or its successor TLS, were considered safe communication methods. But now the era has changed, and SSL and TLS have become corrupted. In the past few years, many serious security vulnerabilities that are worth your attention have been exposed one by one. Some have affected Windows servers, but some have not. The following lists the information you need to know:

Heartbleed vulnerability is an OpenSSL vulnerability (OpenSSL often runs on some Windows servers) that exploits the vulnerability of TLS heartbeat extension, users who remotely access the server memory and connect to the server.

Poding (Padding Oracle On Downgraded Legacy Encryption) is a man-in-the-middle attack. SSL 3.0 and TLS 1.0 to 1.2 are affected by this vulnerability.

FREAK (Factoring Attack on RSA-EXPORT Keys) is a new vulnerability that allows attackers to forcibly degrade the encryption strength of vulnerable browsers and servers.

Many SSL and TLS vulnerabilities that affect Windows servers can be traced back many years ago. Some of these vulnerabilities affect SSL version 2 and some affect weak encrypted passwords. Interestingly, according to my security evaluation experience, most Windows servers have at least one Vulnerability (many times ). In addition, these servers are exposed on the Internet and are waiting to be cracked.

So how can we know whether your Windows server has these so-called vulnerabilities? It's easy to do the following:

Use WSUS, MBSA, or third-party patch management software to check for unused patches (Note: patching alone does not fix all SSL/TLS vulnerabilities, such as heartbleed vulnerabilities ).

Use Nexpose, GFI vulnerability ARD, or web-based vulnerability scanner (such as Netsparker or Acunetix) for vulnerability scanning.

Use a webpage similar to ssl labs ssl Server Test and freakattack.com to check your existing configurations and vulnerabilities.

After talking about the dangers of SSL and TLS, the real danger is not because data is transmitted over the Internet, but the system itself. If the SSL and TLS versions running on your Windows server have known vulnerabilities, you are asking for trouble. Think about what will happen in this case. The best case is that you will find these problems in the vulnerability assessment or audit and fix them as required .. The worst case is that someone uses a heartbleed vulnerability or similar vulnerability to leak your data. I believe you will not encounter any situation.

The best way to deal with Windows servers is to fix these annoying security problems and solve them, but not just fix them. You must also be vigilant, which means that you must have a dim sum when performing security checks and necessary maintenance to make the system more flexible to prevent attacks. This is not just for all known risks, we should see it further.