Covers: Vulnerabilities & PatchingGovernance, Risk & ComplianceCloud SecurityData BreachesAI SecurityThreat Actors & Nation-StateSupply Chain & AppSecDetection & ResponseZero-Days & ExploitsEndpoint & Network Security
After the SSL/TLS Authentication Gap was discovered, some sites that did not need renegotiation dealt with it by disabling renegotiation in server code, while sites that needed it waited for the TLS working group's protocol fix and for vendor support....
Slow HTTP attacks exploit the HTTP protocol's requirement that requests be fully received before processing, so a single machine can open thousands of unfinished requests using minimal bandwidth and tie up server resources until a denial of service occurs....
Qualys researcher Sergey Shekyan released slowhttptest, an open-source tool that opens and maintains configurable slow HTTP connections to measure a server's limits, inspired by Robert "Rsnake" Hansen's Slowloris and Tom Brennan's OWASP slow post tools. In...
Qualys researcher discovered CVE-2011-4317, a reverse proxy URL validation flaw that survived the patch for the earlier CVE-2011-3368, and Apache made the issue public after receiving the advisory and proof of concept. The CVE-2011-3368 patch in...
Juliano Ruhl and Thai Duong presented CRIME, a practical attack against how TLS is used in browsers, at Ekoparty on September 21, 2012; the root cause is information leakage that occurs when data is compressed before encryption. The exploit uses JavaScript...
Researchers Nadhem AlFardan, Dan Bernstein, Kenny Paterson, Bertram Poettering and Jacob Schuldt announced new weaknesses in RC4 and new methods to exploit them, after RC4 usage had grown to roughly 50% of all TLS traffic as a workaround for the BEAST...
Qualys describes how its Web Application Scanner detects reflected XSS by sending test payloads and checking whether the response HTML is altered in a way that changes the document's structure, rather than relying on pattern matching for strings like...
This Qualys post explains that the RSA key exchange used in most SSL/TLS handshakes lets anyone holding a copy of the server's private key recover the session keys and decrypt past conversations. It describes forward secrecy, achieved with ephemeral...
A Qualys blog post, now marked obsolete, laid out detailed Apache, Nginx, and OpenSSL configuration for Forward Secrecy, requiring both the web server and the underlying SSL/TLS library to support Elliptic Curve cryptography. The post notes that Red Hat...
Qualys changed its SSL Labs rating criteria to stop penalizing sites that lack server-side BEAST mitigations, on the basis that the attack is sufficiently mitigated client-side. The BEAST flaw lets an active man-in-the-middle predict the initialization...
Qualys announced it was named a 2014 SC Awards U.S. finalist in five categories, including Best Security Company, Best Customer Service, and the Reader's Trust Award for Best Vulnerability Management Solution for QualysGuard VM. QualysGuard Express was...
Bash processes specially crafted environment variables in a way that allows remote code execution, and because Bash is a common install on Linux and Unix systems and is invoked by programs like SSH, telnet and CGI scripts, the flaw can be reached over the...
Qualys is working to integrate its Web Application Scanning and Vulnerability Management detection tools with its Web Application Firewall, feeding WAF-observed traffic back into the scanner to reveal site areas hidden behind higher authentication levels...
Qualys reported on October 14 that the POODLE attack (CVE-2014-3566) exploits a flaw in the CBC encryption scheme as implemented in SSL 3, and is conceptually similar to the 2011 BEAST exploit. Exploiting it requires an attacker to inject malicious...
Qualys researchers found a buffer overflow in the __nss_hostname_digits_dots() function of glibc, triggerable locally and remotely through the gethostbyname() functions, and disclosed it with coordinated patches released January 27, 2015. The flaw dates to...
Qualys researcher Ivan Ristić argues that HTTP Public Key Pinning (HPKP, RFC 7469) is too difficult and too dangerous to use, citing Scott Helme's August 2016 finding of only 375 sites with HPKP deployed and 76 in report-only mode, against roughly 30,000...
Qualys extended its Web Application Scanning product with a new automated mechanism for detecting DOM-based XSS, which it says requires no special setup or knowledge. The method instruments the browser's JavaScript execution engine to track strings passed...
Cisco's 2017 Midyear Cybersecurity Report forecasts the emergence of "destruction of service" (DeOS) attacks meant to wreck breached IT systems, alongside growing use of hijacked IoT devices in DDoS attacks. The report also cites IC3 figures showing...
Qualys announced SSL Labs grading changes effective March 1, 2018: servers without forward secrecy or AEAD suites will be capped at grade B, and servers vulnerable to the ROBOT attack will receive an F. The update also assigns a T grade to Symantec...
At RSA Conference 2018, Qualys Director of Product Management Asif Karel said most organizations lack full, continuously updated inventories of their digital certificates, and Qualys SSL Labs' SSL Pulse rated 43% of 150,000 monitored websites as having...
Qualys cites a statistic that almost 30% of CVEs disclosed in 2017 carried a High or Critical CVSS score, roughly 3,000 vulnerabilities or about 58 per week. Forrester analyst Josh Zelonis, citing a 2017 Forrester survey, said 58% of global businesses...
Qualys SSL Labs' SSL Pulse, monitoring 150,000 websites, rated about 43% as having inadequate security in its May report, citing 5,500 expired and 6,000 soon-to-expire certificates, 5,000 weak cipher suites, and obsolete protocols including 20,000 uses of...
At QSC18 Virtual Edition, Qualys Chief Product Officer Sumedh Thakar said digital transformation gives organizations a chance to build security into hybrid IT infrastructure rather than bolting it on afterward, and argued that fragmented point-product...
Qualys reported on CVE-2018-11776, a remote code execution vulnerability in Apache Struts 2 disclosed the prior day, caused by improper namespace validation that allows OGNL injection and can lead to full remote code execution on the target system. Struts...
SiteLock researchers reported that a website is attacked on average almost 60 times per day, and that 1% of all websites — about 19 million globally — carry malware at any point in time, including sites from large, well-known companies. Newegg, British...
Qualys announced that QIDs 38601 and 42366 will be marked as PCI Fail on May 1, 2019, per the ASV Program Guide, which requires automatic failure for components supporting SSL or early TLS, or strong cryptography alongside them due to forced-downgrade...
Qualys SSL Labs published warnings for four CBC-mode vulnerabilities - Zombie POODLE, GOLDENDOODLE, 0-Length OpenSSL and Sleeping POODLE - that apply to servers using TLS 1.0, 1.1 or 1.2 with CBC cipher modes. SSL Labs began marking CBC cipher suites...
LinkedIn users on Tuesday received browser warnings about an insecure connection after an expired TLS certificate, which LinkedIn described as a "brief delay" in updating a digital certificate and said did not affect member data. Qualys SSL Labs' SSL...
Qualys published a FedRAMP Vulnerability Mitigation by SLA dashboard to help Cloud Service Providers track remediation deadlines under the RA-5d control. Under FedRAMP Continuous Monitoring, CSPs must send reviewers updated artifacts every 30 days showing...
CVE-2019-11043 is a remote code execution flaw in PHP 7 versions below 7.1.33, 7.2.24 and 7.3.11, affecting only NGINX servers with PHP-FPM enabled, where crafted requests can cause the FPM module to write past allocated buffers and execute system...