{"action":"created","issue":{"url":"https://api.github.com/repos/isvsecwatch/httpstracker/issues/20","labels_url":"https://api.github.com/repos/isvsecwatch/httpstracker/issues/20/labels{/name}","comments_url":"https://api.github.com/repos/isvsecwatch/httpstracker/issues/20/comments","events_url":"https://api.github.com/repos/isvsecwatch/httpstracker/issues/20/events","html_url":"https://github.com/isvsecwatch/httpstracker/issues/20","id":63523856,"number":20,"title":"web.marketcircle.net - application backend","user":{"login":"sindarina","id":6074566,"avatar_url":"https://avatars.githubusercontent.com/u/6074566?v=3","gravatar_id":"","url":"https://api.github.com/users/sindarina","html_url":"https://github.com/sindarina","followers_url":"https://api.github.com/users/sindarina/followers","following_url":"https://api.github.com/users/sindarina/following{/other_user}","gists_url":"https://api.github.com/users/sindarina/gists{/gist_id}","starred_url":"https://api.github.com/users/sindarina/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/sindarina/subscriptions","organizations_url":"https://api.github.com/users/sindarina/orgs","repos_url":"https://api.github.com/users/sindarina/repos","events_url":"https://api.github.com/users/sindarina/events{/privacy}","received_events_url":"https://api.github.com/users/sindarina/received_events","type":"User","site_admin":false},"labels":[{"url":"https://api.github.com/repos/isvsecwatch/httpstracker/labels/Client-Side%20Cipher%20Ordering","name":"Client-Side Cipher Ordering","color":"fbca04"},{"url":"https://api.github.com/repos/isvsecwatch/httpstracker/labels/DH%201024-bit","name":"DH 1024-bit","color":"eb6420"},{"url":"https://api.github.com/repos/isvsecwatch/httpstracker/labels/Insecure","name":"Insecure","color":"e11d21"},{"url":"https://api.github.com/repos/isvsecwatch/httpstracker/labels/No%20ECDHE","name":"No ECDHE","color":"fbca04"},{"url":"https://api.github.com/repos/isvsecwatch/httpstracker/labels/No%20Forward%20Secrecy","name":"No Forward Secrecy","color":"fbca04"},{"url":"https://api.github.com/repos/isvsecwatch/httpstracker/labels/No%20HSTS","name":"No HSTS","color":"207de5"},{"url":"https://api.github.com/repos/isvsecwatch/httpstracker/labels/SHA1%20Certificate","name":"SHA1 Certificate","color":"fbca04"},{"url":"https://api.github.com/repos/isvsecwatch/httpstracker/labels/SSLv3","name":"SSLv3","color":"eb6420"},{"url":"https://api.github.com/repos/isvsecwatch/httpstracker/labels/TLS%20Compression","name":"TLS Compression","color":"e11d21"},{"url":"https://api.github.com/repos/isvsecwatch/httpstracker/labels/TLSv1%20Only","name":"TLSv1 Only","color":"fbca04"},{"url":"https://api.github.com/repos/isvsecwatch/httpstracker/labels/Vulnerability","name":"Vulnerability","color":"e11d21"},{"url":"https://api.github.com/repos/isvsecwatch/httpstracker/labels/Weak","name":"Weak","color":"eb6420"}],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":5,"created_at":"2015-03-22T11:42:27Z","updated_at":"2015-04-03T11:55:52Z","closed_at":null,"body":"**SSL Server Test Results**\r\nhttps://www.ssllabs.com/ssltest/analyze.html?d=web.marketcircle.net (C)\r\n\r\n**Cipherscan Results**\r\n```\r\nTarget: web.marketcircle.net:443\r\n\r\nprio  ciphersuite           protocols    pfs_keysize\r\n1     DHE-RSA-AES256-SHA    SSLv3,TLSv1  DH,1024bits\r\n2     AES256-SHA            SSLv3,TLSv1\r\n3     DHE-RSA-AES128-SHA    SSLv3,TLSv1  DH,1024bits\r\n4     AES128-SHA            SSLv3,TLSv1\r\n5     EDH-RSA-DES-CBC3-SHA  SSLv3,TLSv1  DH,1024bits\r\n6     DES-CBC3-SHA          SSLv3,TLSv1\r\n\r\nCertificate: trusted, 4096 bit, sha1WithRSAEncryption signature\r\nTLS ticket lifetime hint: None\r\nOCSP stapling: not supported\r\nClient side cipher ordering\r\n```\r\n\r\n**Cipherscan Results (Analysis)**\r\n```\r\nweb.marketcircle.net:443 has bad ssl/tls\r\n\r\nThings that are bad:\r\n* remove cipher EDH-RSA-DES-CBC3-SHA\r\n\r\nChanges needed to match the intermediate level:\r\n* remove cipher EDH-RSA-DES-CBC3-SHA\r\n* disable SSLv3\r\n* consider enabling TLSv1.1\r\n* consider enabling TLSv1.2\r\n* consider using a SHA-256 certificate\r\n* consider using DHE of at least 2048bits and ECC of at least 256bits\r\n* consider enabling OCSP Stapling\r\n* enforce server side ordering\r\n\r\nChanges needed to match the modern level:\r\n* remove cipher AES256-SHA\r\n* remove cipher AES128-SHA\r\n* remove cipher EDH-RSA-DES-CBC3-SHA\r\n* remove cipher DES-CBC3-SHA\r\n* disable TLSv1\r\n* disable SSLv3\r\n* consider enabling TLSv1.1\r\n* consider enabling TLSv1.2\r\n* use a SHA-256 certificate\r\n* use DHE of at least 2048bits and ECC of at least 256bits\r\n* consider enabling OCSP Stapling\r\n* enforce server side ordering\r\n```\r\n\r\n**Verdict**\r\nThis is part of the 'unseen' web servers that Marketcircle operates; it's the target server for logins from their Billings Pro app, for example. Which, as the name suggests, is an app for billing/invoicing, with all your client data, syncing between Macs, iPads, and iPhones. Shame on them. Seriously."},"comment":{"url":"https://api.github.com/repos/isvsecwatch/httpstracker/issues/comments/89266873","html_url":"https://github.com/isvsecwatch/httpstracker/issues/20#issuecomment-89266873","issue_url":"https://api.github.com/repos/isvsecwatch/httpstracker/issues/20","id":89266873,"user":{"login":"sindarina","id":6074566,"avatar_url":"https://avatars.githubusercontent.com/u/6074566?v=3","gravatar_id":"","url":"https://api.github.com/users/sindarina","html_url":"https://github.com/sindarina","followers_url":"https://api.github.com/users/sindarina/followers","following_url":"https://api.github.com/users/sindarina/following{/other_user}","gists_url":"https://api.github.com/users/sindarina/gists{/gist_id}","starred_url":"https://api.github.com/users/sindarina/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/sindarina/subscriptions","organizations_url":"https://api.github.com/users/sindarina/orgs","repos_url":"https://api.github.com/users/sindarina/repos","events_url":"https://api.github.com/users/sindarina/events{/privacy}","received_events_url":"https://api.github.com/users/sindarina/received_events","type":"User","site_admin":false},"created_at":"2015-04-03T11:55:52Z","updated_at":"2015-04-03T11:55:52Z","body":"Apparently they did turn off SSLv3 this week, but there are several issues that still need to be resolved.\r\n```\r\nweb.marketcircle.net:443 has bad ssl/tls\r\n\r\nThings that are bad:\r\n* remove cipher EDH-RSA-DES-CBC3-SHA\r\n\r\nChanges needed to match the intermediate level:\r\n* remove cipher ECDHE-RSA-DES-CBC3-SHA\r\n* remove cipher EDH-RSA-DES-CBC3-SHA\r\n* consider using a SHA-256 certificate\r\n* consider using DHE of at least 2048bits and ECC of at least 256bits\r\n* consider enabling OCSP Stapling\r\n* enforce server side ordering\r\n\r\nChanges needed to match the modern level:\r\n* remove cipher DHE-RSA-CAMELLIA256-SHA\r\n* remove cipher AES256-GCM-SHA384\r\n* remove cipher AES256-SHA256\r\n* remove cipher AES256-SHA\r\n* remove cipher CAMELLIA256-SHA\r\n* remove cipher DHE-RSA-CAMELLIA128-SHA\r\n* remove cipher AES128-GCM-SHA256\r\n* remove cipher AES128-SHA256\r\n* remove cipher AES128-SHA\r\n* remove cipher CAMELLIA128-SHA\r\n* remove cipher ECDHE-RSA-DES-CBC3-SHA\r\n* remove cipher EDH-RSA-DES-CBC3-SHA\r\n* remove cipher DES-CBC3-SHA\r\n* disable TLSv1\r\n* use a SHA-256 certificate\r\n* use DHE of at least 2048bits and ECC of at least 256bits\r\n* consider enabling OCSP Stapling\r\n* enforce server side ordering\r\n```"}}