Insecure Network Communication

Securing TLS configuration

About Insecure TLS Configuration

What is insecure TLS configuration?

Insecure TLS (Transport Layer Security) configuration refers to the use of weak or vulnerable cryptographic algorithms or protocols in the configuration of TLS on a system or application.

TLS is used to secure communication channels between clients and servers. Insecure TLS configuration can lead to a range of security vulnerabilities.

Check out these videos for a high-level explanation:

• Weak Algorithms

• Weak Cipher Suites

What is the impact of insecure TLS configuration?

Insecure TLS (Transport Layer Security) configuration can have significant impacts on the security and privacy of communication channels between clients and servers.

Here are some of the potential impacts:

• Man-in-the-middle (MITM) attacks: Weak or outdated cryptographic algorithms can be exploited by attackers to intercept and modify data in transit between a client and server. This can enable attackers to steal sensitive data or manipulate communication channels to launch other attacks.
• Information disclosure: Insecure TLS configuration can allow attackers to gain access to sensitive data, such as login credentials or personal information, transmitted between the client and server. This can lead to data breaches or compromise of sensitive information.

How to prevent insecure TLS configuration?

To prevent insecure TLS (Transport Layer Security) configuration, several measures can be taken, including:

• Use strong cryptographic algorithms and protocols: Use strong cryptographic algorithms and protocols, such as TLS 1.2 or higher, and disable outdated or weak algorithms, such as SSLv2 and SSLv3. This can help prevent attackers from exploiting vulnerabilities in the encryption and authentication processes.
• Use appropriate key sizes: Use appropriate key sizes to ensure that the cryptographic keys used in the TLS communication are strong enough to resist attacks. Key sizes of 2048 bits or higher are recommended.
• Regularly update software and systems: Regularly update software and systems to ensure that the latest security patches are applied and known vulnerabilities are addressed.

References

Taxonomies

• OWASP Top 10 - A02 Cryptographic Failures
• CWE-327: Use of a Broken or Risky Cryptographic Algorithm

Explanation & Prevention

• OWASP: Transport Layer Protection Cheat Sheet
• WASC-04: Insufficient Transport Layer Protection
• POODLE (CVE Details)
• BEAST (CVE Details)
• CRIME (CVE Details)
• FREAK (CVE Details)
• BREACH (CVE Details)
• LOGJAM (CVE Details)

Related CVEs

• CVE Details: CWE-327

Training

• Secure Code Warrior: Weak TLS Algorithms
• Secure Code Warrior: Weak TLS Cipher Suites

Option A: Properly Set SSL Padding

1. Go through the issues that GuardRails identified in the PR/MR

2. Replace OPENSSL_PKCS1_PADDING:

   openssl_public_encrypt($i,$e,$k, OPENSSL_PKCS1_PADDING);

   with OPENSSL_PKCS1_OAEP_PADDING:

   # Ensure that you have a valid certificate.
   # Get free certificates at https://letsencrypt.org/
   openssl_public_encrypt($i,$e,$k, OPENSSL_PKCS1_OAEP_PADDING);

3. Test it

4. Ship it 🚢 and relax 🌴