Re: [TLS] The risk of misconfiguration

On Tue, May 6, 2014 at 2:53 PM, Alyssa Rowan <akr@akr.io> wrote:
> -----BEGIN PGP SIGNED MESSAGE-----
> Hash: SHA512
>
> On 06/05/2014 19:48, Watson Ladd wrote:
>
>> I think the number of people who accidentally enabled ADH is an
>> order of magnitude more than those who actually wanted it.
>
> +1. I never saw anyone enable ADH, NULL or EXPORT cipher suites
> actually on purpose. I have definitely seen people do it by accident.

I've seen someone do it on purpose -- kinda....

Many years ago I was working for a large registrar -- we had an F5
load balancer that directed HTTP to one set of hosts, and HTTPS to
another set. One day one of the sysadmins noticed that the HTTPS
servers ran *much* hotter than the HTTP ones (for the same QPS). He
came and asked me what to do about this, and I suggested that he go
investigate and figure out why - I thought it would be a useful
learning experience...

Anyway, a month or two later we have some really weird network issue,
so  I fire up a sniffer -- and in one of the packets I see something
that is fairly clearly a name and credit card number. Much panic
ensues -- and then I discover how he has "solved" the issue -- yup, he
has managed to disable everything, and then enable only NULL. He had
no idea why, but he;d poked at things, and now the CPU on the HTTPS
servers was much closer to the HTTP ones. Win!

W

>
> The mere presence of NULL ciphersuites is dangerous: someone might
> actually use them, and that's basically never a good idea.
>
> Take them out; keep them out; don't put them back in.
>
> - --
> /akr
> -----BEGIN PGP SIGNATURE-----
>
> iQIcBAEBCgAGBQJTaS/CAAoJEOyEjtkWi2t6q34P/j5QX4BBRJLusLx3cevVdxmM
> JXHnhPDY+ovbHSs1XkASJAS4x/k40IN2maj+8E47Me/ZsTriJd8659vq9jxQeTT4
> f04TBYGphcBQupZg136CVcsA1WSFiWo1UfXffW8oRAQfU2CpVdeKb/0IFLgQ64sa
> G37UAxFtKTnFVtrec1Q5tdwfSdc6nEP2zbzpaAVB96vqJuel/bNtOFQM44CriPQ3
> LbtIX3MMh0qfBAxwmTwe9+YahzGuCxIAStHwJl4JD3ReTJHlo/lxlDNIVt46nkzv
> HYB3moJ1tDlzpFn0xWNQHrKcN5GtotktsV12Uyq91DvAd6U/CHQD13h9cO5OmCDT
> Sb+S+0OmHeXah6A0zBe7DSJS+yf4pqjQazFaQyP6z0SLdh4krhvKP2hGiuDvTMyf
> b2WVOmd1ThitIqoFYfS8VhpbEOFrUDl4y6LYAEJgqCET20BK5Qal0doENrsTE260
> 57oFR7wygJpc4Y5yGZ4sWfOqRuowbJm7ZSdYguMv2VuS84M3BdhFHaitYyrEbZRR
> 9r6uuZR7d+VIR9nhLYXTFK9I4B2DDr6joLaVTzDB4W2tf6xHL2RsIRXnwCj3UdAQ
> XOHKtnQ+RCsHCUUetKsOx8Arc7IQb5R4f/qPF3bvhWWc4Q7dJevXcViz7eWaJ9MZ
> BK5q7JpBLXskyfIpToPR
> =DOKC
> -----END PGP SIGNATURE-----
>
> _______________________________________________
> TLS mailing list
> TLS@ietf.org
> https://www.ietf.org/mailman/listinfo/tls