This doesn't even match the way TLS works. You can't specify something like "SSL 2.0 and TLS 1.0". At most you can abort the connection afterwards.
But in general an assumption behind SSL version negotiation is that an SSL client or server supports the whole range between a minimum and a maximum version with no holes.
@RoryAlsop ahh could be I gues, wonder if that'll delay the exploit for MS14-066? I see there's one out for the IE bug MS14-064 which apparently works all the way back to IE3 on Win95
hey @ThomasPornin @terrychia do either of your SSL scanners check for the cipher suites that MS introduced with that patch?
@Lighty but that's a huge field, what did you do in the class? Was it like (For example) developing Android apps, or was it "This is how Java works", or something else entirely?
@Tinned_Tuna a more general programming and scripting class, its higher than standard level over here in the netherlands (for reference, the course is MBO4)
that means i "master" HTML, CSS, JScript, PHP, ASP.NET, know how to configure a windows server, know how to work with MS Office Access, Excel, Word, and know how SQLite and MySQL works
but this course is given by shitty teachers, so i'm not really getting the course i want :/
Does anybody know why would the IT manager request the employees email passwords for email migration?
I don't know the process of email migration but does anybody know if it necessarily require the employees email passwords?? what is the best thing to do in this case -.-
@Lamia I can think of several reasons, they're all pretty bad IT practice :)
Assuming that you trust them with the contents of your mailfile (And I'd assume you do as you work for them), if I were you I'd change my password to something random before the migration, then change it again immediately after the migration
The sad thing is, I just made a security awareness orientation to the employees and I almost died convincing them never to share their passwords. Now I should find a way to convince them that's special case or something
Do you think I should email them and tell them to do what @RоryMcCune just told me?
There is something else, I don't think it is right to send even my temporary password through email. What other channels would u suggest we use to send our passwods?
@Lamia well here's the thing, once IT get your password what are they going to do with it? I'm guessing this is either 'cause their migration tool needs to log in as the user, or they're being "nice" and setting the migrated account password to the same as the old one
either way they'll be writing it down in the clear somewhere while they work on it
so if you accept the bad practice you're getting from IT, is sending it via Internal mail (I'm assuming you're internal mail stays on your internal network) worse than that?
@RоryMcCune I hate that I should accept it. Either way, I should conduct another awareness presentation to the employees and explain them the case :C they would not trust wt I'd tell them after this case lol
@RоryMcCune No time to catch up with infosec happenings lately. :( It's easy to add additional cipher suites to my scanner though, I just need the ID MS is using.
Hey @rapid7 how come unencrypted FTP is a CVSS 7 http://www.rapid7.com/db/vulnerabilities/ftp-plaintext-auth and unencrypted telnet is a CVSS 4 http://www.rapid7.com/db/vulnerabilities/telnet-open-port ?
@RoryAlsop ta, I have the fun of doing a PCI test this week so the inconsistencies of finding levels are annoying me :)
what's perhaps even funnier is that MITM bugs in SSL and things like self-signed certs are rated higher than running an entirely unencrypted protocol (telnet)
so theoretically you can improve your security by running plain HTTP
you know, I know just the right guys that would be up to it and try it in a real cave
and if it sets some record they're prolly already on it
we do have one cave that's so bleeping touristic that it even has an electric train and lights all through it ... I wouldn't be too surprised it they installed GSM repeaters in it too by now
@RоryMcCune If we really want to justify the difference in classification, one could argue that basic users are much more likely to use FTP than Telnet, since a basic Windows includes a client for the former (the file explorer) but not for the latter (at least my desktop system does not appear to have a Telnet client).
@ThomasPornin the annoying bit is this is CVSS ratings which are meant to be "objective" and when you look at it telnet is (AV:N/AC:M/Au:N/C:P/I:N/A:N) and FTP is (AV:A/AC:M/Au:N/C:C/I:C/A:N) so apparently the difference is that compromising a telnet password only has a "partial" effect on confidentiality and has to happen from an "adjacent" network where for FTP it's a "full" compromise of confidentiality and can happen from anywhere!
@paj28 oh I knew it was balls but I didn't realise the scanners couldn't even get basic consistency on easy findings right
and when it's PCI it actually matters to companies
as they'll get a fail for that cleartext FTP which could just allow access to public info. and a pass with cleartext telnet that could be an admin login to a router
@paj28 Everyone gripes about it, but then then we're all still expected to use it to score every new vulnerability ever. So until that expectation goes away, it's going to continue to be a thorn in our sides.
I have a Web application running on port 89 ( non-standard port) of a Windows 2012 R2 machine. The login page for this application needs to be accessible through a link on my website - let's call it mydomain-llc.com. I have created a button on the home page which currently explicitly provides the...
@paj28 Oh yeah? Good for you guys...It's not often you see companies willing to step up and throw out the cherished institutions of the industry even though they're insufferably stupid. And it's even better to hear that you're not getting push-back from clients. That leads me to believe that there is hope after all. :-)
@paj28 ooh too long for a post, I'll drop you a mail, though I think it's changed to a new exam since I last took it, but I can give some general advice :)
@paj28 the main thing is being slick with the tools & techniques, having all your refs and tools on your laptop 'cause the Internet access onsite is a pain, and watch your time on the practical 'cause it's tough to get round it all in the time given
Is it a good idea to buy Diablo III as a present for my GF? she enjoyed 2 veeeery much, but wants something thats a bit easier with MP, she'll join the team with me and dad :o
being build on the CryEngine, concidered worlds most advanced graphic engine, Farcry one through 3 are really beautifull games, but the gameplay is really awesome too, number one is classic FPS singleplayer action and fun MP for the time (2004), while farcry 3 takes the cake as GOTY for me on its release (2012?)
@Adnan this one is going to cause havok with slow patchers, we see quite a bit of RDP exposed on the Internet and I don't think people realise that this bug applies
Also I read a post saying it causes big slowdowns on SQL servers, so some people may not apply to avoid the issue...
I use iOS7 with a 4-digit passcode that isn't on any top 10 lists. I have "Erase all data after 10 failed passcode attempts" turned on.
How hard would it be for someone who stole my phone to get access to my email?
I use iOS7 with a 4-digit passcode that isn't on any top 10 lists. I have "Erase all data after 10 failed passcode attempts" turned on.
How hard would it be for someone who stole my phone to get access to my email?
