search

isvsecwatch / httpstracker

Our main issue tracker for ISV security issues, such as the SSL/TLS configuration of their online stores.
3 stars 0 forks source link

store.diditbetter.com - order/ecommerce website #40

Closed sindarina closed 9 years ago

sindarina commented 9 years ago

SSL Server Test Results https://www.ssllabs.com/ssltest/analyze.html?d=store.diditbetter.com (F)

Cipherscan Results

Target: store.diditbetter.com:443

prio  ciphersuite           protocols          pubkey_size  signature_algorithm      trusted  ticket_hint  ocsp_staple  pfs_keysize
1     AES128-SHA            TLSv1              2048         sha256WithRSAEncryption  True     None         True
2     AES256-SHA            TLSv1              2048         sha256WithRSAEncryption  True     None         True
3     RC4-SHA               SSLv3,TLSv1        2048         sha256WithRSAEncryption  True     None         True
4     DES-CBC3-SHA          SSLv3,TLSv1        2048         sha256WithRSAEncryption  True     None         True
5     ECDHE-RSA-AES128-SHA  TLSv1              2048         sha256WithRSAEncryption  True     None         True         ECDH,P-256,256bits
6     ECDHE-RSA-AES256-SHA  TLSv1              2048         sha256WithRSAEncryption  True     None         True         ECDH,P-256,256bits
7     RC4-MD5               SSLv2,SSLv3,TLSv1  2048         sha256WithRSAEncryption  True     None         True
8     DES-CBC3-MD5          SSLv2              2048         sha256WithRSAEncryption  False    None         False

OCSP stapling: supported
Server side cipher ordering

Cipherscan Analysis

store.diditbetter.com:443 has bad ssl/tls

Things that are bad:
* remove cipher RC4-SHA
* remove cipher RC4-MD5
* remove cipher DES-CBC3-MD5
* disable SSLv2

Changes needed to match the intermediate level:
* remove cipher RC4-SHA
* remove cipher RC4-MD5
* remove cipher DES-CBC3-MD5
* disable SSLv3
* disable SSLv2
* consider enabling TLSv1.1
* consider enabling TLSv1.2
* consider enabling OCSP Stapling

Changes needed to match the modern level:
* remove cipher AES128-SHA
* remove cipher AES256-SHA
* remove cipher RC4-SHA
* remove cipher DES-CBC3-SHA
* remove cipher RC4-MD5
* remove cipher DES-CBC3-MD5
* disable TLSv1
* disable SSLv3
* disable SSLv2
* consider enabling TLSv1.1
* consider enabling TLSv1.2
* consider enabling OCSP Stapling
sindarina commented 9 years ago

Notified via email: info@diditbetter.com

sindarina commented 9 years ago

Poked on Twitter: https://twitter.com/isvsecwatch/status/595336965270155265

sindarina commented 9 years ago

Most likely a box with IIS default settings, which aren't very secure. Suggestions for improvement here; https://github.com/isvsecwatch/httpstracker/blob/master/server-tips-iis.md

sindarina commented 9 years ago

No change.

sindarina commented 9 years ago

No change. Re-notified via email; info@diditbetter.com

sindarina commented 9 years ago

No change.

sindarina commented 9 years ago

No change.

sindarina commented 9 years ago

No change, still broken.

sindarina commented 9 years ago

A new RC4 attack, NOMORE, was released today; http://www.rc4nomore.com/

Please update your systems.

sindarina commented 9 years ago

No change, still a big red F.

Target: store.diditbetter.com:443

prio  ciphersuite           protocols          pubkey_size  signature_algorithm      trusted  ticket_hint  ocsp_staple  pfs_keysize
1     AES128-SHA            TLSv1              2048         sha256WithRSAEncryption  True     None         True
2     AES256-SHA            TLSv1              2048         sha256WithRSAEncryption  True     None         True
3     RC4-SHA               SSLv3,TLSv1        2048         sha256WithRSAEncryption  True     None         True
4     DES-CBC3-SHA          SSLv3,TLSv1        2048         sha256WithRSAEncryption  True     None         True
5     ECDHE-RSA-AES128-SHA  TLSv1              2048         sha256WithRSAEncryption  True     None         True         ECDH,P-256,256bits
6     ECDHE-RSA-AES256-SHA  TLSv1              2048         sha256WithRSAEncryption  True     None         True         ECDH,P-256,256bits
7     RC4-MD5               SSLv2,SSLv3,TLSv1  2048         sha256WithRSAEncryption  True     None         True
8     DES-CBC3-MD5          SSLv2              2048         sha256WithRSAEncryption  False    None         False

OCSP stapling: supported
Server side cipher ordering
isvsecwatch-report commented 9 years ago

Unchanged, completely unresponsive. Closing as unresolved.