Is BEAST Still a Threat? | Qualys
Summary: Qualys changed its SSL Labs rating criteria to stop penalizing sites that lack server-side BEAST mitigations, on the basis that the attack is sufficiently mitigated client-side. The BEAST flaw lets an active man-in-the-middle predict the initialization vectors used to mask plaintext in TLS 1.0 and earlier, and most major browsers addressed it with the 1/n-1 split, but Apple's Mountain Lion shipped the split disabled by default and it was not in use on iOS.
Bottom line: The only server-side fix was enforcing RC4, a cipher the same research found weaker than previously thought, so the two risks were roughly equal and low. The author still calls for Safari to enable the 1/n-1 split by default, warning that a new Safari feature could make BEAST exploitable again tomorrow.
Read the original at Qualys Blog ↗
- Topics
- Vulnerabilities & Patching
- Related
- Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026