{"action":"created","issue":{"url":"https://api.github.com/repos/isvsecwatch/httpstracker/issues/28","labels_url":"https://api.github.com/repos/isvsecwatch/httpstracker/issues/28/labels{/name}","comments_url":"https://api.github.com/repos/isvsecwatch/httpstracker/issues/28/comments","events_url":"https://api.github.com/repos/isvsecwatch/httpstracker/issues/28/events","html_url":"https://github.com/isvsecwatch/httpstracker/issues/28","id":69396496,"number":28,"title":"app.happymetrix.com - application login","user":{"login":"sindarina","id":6074566,"avatar_url":"https://avatars.githubusercontent.com/u/6074566?v=3","gravatar_id":"","url":"https://api.github.com/users/sindarina","html_url":"https://github.com/sindarina","followers_url":"https://api.github.com/users/sindarina/followers","following_url":"https://api.github.com/users/sindarina/following{/other_user}","gists_url":"https://api.github.com/users/sindarina/gists{/gist_id}","starred_url":"https://api.github.com/users/sindarina/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/sindarina/subscriptions","organizations_url":"https://api.github.com/users/sindarina/orgs","repos_url":"https://api.github.com/users/sindarina/repos","events_url":"https://api.github.com/users/sindarina/events{/privacy}","received_events_url":"https://api.github.com/users/sindarina/received_events","type":"User","site_admin":false},"labels":[{"url":"https://api.github.com/repos/isvsecwatch/httpstracker/labels/Chain%20Issue","name":"Chain Issue","color":"fbca04"},{"url":"https://api.github.com/repos/isvsecwatch/httpstracker/labels/DH%201024-bit","name":"DH 1024-bit","color":"eb6420"},{"url":"https://api.github.com/repos/isvsecwatch/httpstracker/labels/Weak","name":"Weak","color":"eb6420"}],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":7,"created_at":"2015-04-19T07:36:28Z","updated_at":"2015-04-27T17:52:44Z","closed_at":null,"body":"**SSL Server Test Results**\r\nhttps://www.ssllabs.com/ssltest/analyze.html?d=app.happymetrix.com (F)\r\n\r\n**Cipherscan Results**\r\n```\r\nTarget: app.happymetrix.com:443\r\n\r\nprio  ciphersuite                  protocols                    pubkey_size  signature_algorithm      trusted  ticket_hint  ocsp_staple  pfs_keysize\r\n1     AECDH-AES256-SHA             SSLv3,TLSv1,TLSv1.1,TLSv1.2  0            None                     True     300          False        ECDH,P-256,256bits\r\n2     AECDH-AES128-SHA             SSLv3,TLSv1,TLSv1.1,TLSv1.2  0            None                     True     300          False        ECDH,P-256,256bits\r\n3     AECDH-RC4-SHA                SSLv3,TLSv1,TLSv1.1,TLSv1.2  0            None                     True     300          False        ECDH,P-256,256bits\r\n4     AECDH-DES-CBC3-SHA           SSLv3,TLSv1,TLSv1.1,TLSv1.2  0            None                     True     300          False        ECDH,P-256,256bits\r\n5     ECDHE-RSA-AES256-GCM-SHA384  TLSv1.2                      2048         sha256WithRSAEncryption  True     300          False        ECDH,P-256,256bits\r\n6     ECDHE-RSA-AES256-SHA384      TLSv1.2                      2048         sha256WithRSAEncryption  True     300          False        ECDH,P-256,256bits\r\n7     ECDHE-RSA-AES256-SHA         SSLv3,TLSv1,TLSv1.1,TLSv1.2  2048         sha256WithRSAEncryption  True     300          False        ECDH,P-256,256bits\r\n8     DHE-RSA-AES256-GCM-SHA384    TLSv1.2                      2048         sha256WithRSAEncryption  True     300          False        DH,1024bits\r\n9     DHE-RSA-AES256-SHA256        TLSv1.2                      2048         sha256WithRSAEncryption  True     300          False        DH,1024bits\r\n10    DHE-RSA-AES256-SHA           SSLv3,TLSv1,TLSv1.1,TLSv1.2  2048         sha256WithRSAEncryption  True     300          False        DH,1024bits\r\n11    DHE-RSA-CAMELLIA256-SHA      SSLv3,TLSv1,TLSv1.1,TLSv1.2  2048         sha256WithRSAEncryption  True     300          False        DH,1024bits\r\n12    AES256-GCM-SHA384            TLSv1.2                      2048         sha256WithRSAEncryption  True     300          False\r\n13    AES256-SHA256                TLSv1.2                      2048         sha256WithRSAEncryption  True     300          False\r\n14    AES256-SHA                   SSLv3,TLSv1,TLSv1.1,TLSv1.2  2048         sha256WithRSAEncryption  True     300          False\r\n15    CAMELLIA256-SHA              SSLv3,TLSv1,TLSv1.1,TLSv1.2  2048         sha256WithRSAEncryption  True     300          False\r\n16    ECDHE-RSA-AES128-GCM-SHA256  TLSv1.2                      2048         sha256WithRSAEncryption  True     300          False        ECDH,P-256,256bits\r\n17    ECDHE-RSA-AES128-SHA256      TLSv1.2                      2048         sha256WithRSAEncryption  True     300          False        ECDH,P-256,256bits\r\n18    ECDHE-RSA-AES128-SHA         SSLv3,TLSv1,TLSv1.1,TLSv1.2  2048         sha256WithRSAEncryption  True     300          False        ECDH,P-256,256bits\r\n19    DHE-RSA-AES128-GCM-SHA256    TLSv1.2                      2048         sha256WithRSAEncryption  True     300          False        DH,1024bits\r\n20    DHE-RSA-AES128-SHA256        TLSv1.2                      2048         sha256WithRSAEncryption  True     300          False        DH,1024bits\r\n21    DHE-RSA-AES128-SHA           SSLv3,TLSv1,TLSv1.1,TLSv1.2  2048         sha256WithRSAEncryption  True     300          False        DH,1024bits\r\n22    DHE-RSA-SEED-SHA             SSLv3,TLSv1,TLSv1.1,TLSv1.2  2048         sha256WithRSAEncryption  True     300          False        DH,1024bits\r\n23    DHE-RSA-CAMELLIA128-SHA      SSLv3,TLSv1,TLSv1.1,TLSv1.2  2048         sha256WithRSAEncryption  True     300          False        DH,1024bits\r\n24    AES128-GCM-SHA256            TLSv1.2                      2048         sha256WithRSAEncryption  True     300          False\r\n25    AES128-SHA256                TLSv1.2                      2048         sha256WithRSAEncryption  True     300          False\r\n26    AES128-SHA                   SSLv3,TLSv1,TLSv1.1,TLSv1.2  2048         sha256WithRSAEncryption  True     300          False\r\n27    SEED-SHA                     SSLv3,TLSv1,TLSv1.1,TLSv1.2  2048         sha256WithRSAEncryption  True     300          False\r\n28    CAMELLIA128-SHA              SSLv3,TLSv1,TLSv1.1,TLSv1.2  2048         sha256WithRSAEncryption  True     300          False\r\n29    IDEA-CBC-SHA                 SSLv3,TLSv1,TLSv1.1,TLSv1.2  2048         sha256WithRSAEncryption  True     300          False\r\n30    ECDHE-RSA-RC4-SHA            SSLv3,TLSv1,TLSv1.1,TLSv1.2  2048         sha256WithRSAEncryption  True     300          False        ECDH,P-256,256bits\r\n31    RC4-SHA                      SSLv3,TLSv1,TLSv1.1,TLSv1.2  2048         sha256WithRSAEncryption  True     300          False\r\n32    RC4-MD5                      SSLv3,TLSv1,TLSv1.1,TLSv1.2  2048         sha256WithRSAEncryption  True     300          False\r\n33    ECDHE-RSA-DES-CBC3-SHA       SSLv3,TLSv1,TLSv1.1,TLSv1.2  2048         sha256WithRSAEncryption  True     300          False        ECDH,P-256,256bits\r\n34    EDH-RSA-DES-CBC3-SHA         SSLv3,TLSv1,TLSv1.1,TLSv1.2  2048         sha256WithRSAEncryption  True     300          False        DH,1024bits\r\n35    DES-CBC3-SHA                 SSLv3,TLSv1,TLSv1.1,TLSv1.2  2048         sha256WithRSAEncryption  True     300          False\r\n36    EDH-RSA-DES-CBC-SHA          SSLv3,TLSv1,TLSv1.1,TLSv1.2  2048         sha256WithRSAEncryption  True     300          False        DH,1024bits\r\n37    DES-CBC-SHA                  SSLv3,TLSv1,TLSv1.1,TLSv1.2  2048         sha256WithRSAEncryption  True     300          False\r\n\r\nOCSP stapling: not supported\r\nClient side cipher ordering\r\n```\r\n**Cipherscan Analysis**\r\n```\r\napp.happymetrix.com:443 has bad ssl/tls\r\n\r\nThings that are bad:\r\n* remove cipher AECDH-AES256-SHA\r\n* remove cipher AECDH-AES128-SHA\r\n* remove cipher AECDH-RC4-SHA\r\n* remove cipher AECDH-DES-CBC3-SHA\r\n* remove cipher DHE-RSA-SEED-SHA\r\n* remove cipher SEED-SHA\r\n* remove cipher IDEA-CBC-SHA\r\n* remove cipher ECDHE-RSA-RC4-SHA\r\n* remove cipher RC4-SHA\r\n* remove cipher RC4-MD5\r\n* remove cipher EDH-RSA-DES-CBC3-SHA\r\n* remove cipher EDH-RSA-DES-CBC-SHA\r\n* remove cipher DES-CBC-SHA\r\n\r\nChanges needed to match the intermediate level:\r\n* remove cipher AECDH-AES256-SHA\r\n* remove cipher AECDH-AES128-SHA\r\n* remove cipher AECDH-RC4-SHA\r\n* remove cipher AECDH-DES-CBC3-SHA\r\n* remove cipher DHE-RSA-SEED-SHA\r\n* remove cipher SEED-SHA\r\n* remove cipher IDEA-CBC-SHA\r\n* remove cipher ECDHE-RSA-RC4-SHA\r\n* remove cipher RC4-SHA\r\n* remove cipher RC4-MD5\r\n* remove cipher ECDHE-RSA-DES-CBC3-SHA\r\n* remove cipher EDH-RSA-DES-CBC3-SHA\r\n* remove cipher EDH-RSA-DES-CBC-SHA\r\n* remove cipher DES-CBC-SHA\r\n* disable SSLv3\r\n* consider using a SHA-256 certificate\r\n* consider using DHE of at least 2048bits and ECC of at least 256bits\r\n* consider enabling OCSP Stapling\r\n* enforce server side ordering\r\n\r\nChanges needed to match the modern level:\r\n* remove cipher AECDH-AES256-SHA\r\n* remove cipher AECDH-AES128-SHA\r\n* remove cipher AECDH-RC4-SHA\r\n* remove cipher AECDH-DES-CBC3-SHA\r\n* remove cipher DHE-RSA-CAMELLIA256-SHA\r\n* remove cipher AES256-GCM-SHA384\r\n* remove cipher AES256-SHA256\r\n* remove cipher AES256-SHA\r\n* remove cipher CAMELLIA256-SHA\r\n* remove cipher DHE-RSA-SEED-SHA\r\n* remove cipher DHE-RSA-CAMELLIA128-SHA\r\n* remove cipher AES128-GCM-SHA256\r\n* remove cipher AES128-SHA256\r\n* remove cipher AES128-SHA\r\n* remove cipher SEED-SHA\r\n* remove cipher CAMELLIA128-SHA\r\n* remove cipher IDEA-CBC-SHA\r\n* remove cipher ECDHE-RSA-RC4-SHA\r\n* remove cipher RC4-SHA\r\n* remove cipher RC4-MD5\r\n* remove cipher ECDHE-RSA-DES-CBC3-SHA\r\n* remove cipher EDH-RSA-DES-CBC3-SHA\r\n* remove cipher DES-CBC3-SHA\r\n* remove cipher EDH-RSA-DES-CBC-SHA\r\n* remove cipher DES-CBC-SHA\r\n* disable TLSv1\r\n* disable SSLv3\r\n* use a SHA-256 certificate\r\n* use DHE of at least 2048bits and ECC of at least 256bits\r\n* consider enabling OCSP Stapling\r\n* enforce server side ordering\r\n```\r\n**Verdict**\r\nThis is even more embarrassing than the previous ticket for the OpenVPN support website. Same errors, such as export and anonymous ciphers, but also vulnerable to POODLE, no server-side cipher preference, and so on. Bad. BAD."},"comment":{"url":"https://api.github.com/repos/isvsecwatch/httpstracker/issues/comments/96757364","html_url":"https://github.com/isvsecwatch/httpstracker/issues/28#issuecomment-96757364","issue_url":"https://api.github.com/repos/isvsecwatch/httpstracker/issues/28","id":96757364,"user":{"login":"sindarina","id":6074566,"avatar_url":"https://avatars.githubusercontent.com/u/6074566?v=3","gravatar_id":"","url":"https://api.github.com/users/sindarina","html_url":"https://github.com/sindarina","followers_url":"https://api.github.com/users/sindarina/followers","following_url":"https://api.github.com/users/sindarina/following{/other_user}","gists_url":"https://api.github.com/users/sindarina/gists{/gist_id}","starred_url":"https://api.github.com/users/sindarina/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/sindarina/subscriptions","organizations_url":"https://api.github.com/users/sindarina/orgs","repos_url":"https://api.github.com/users/sindarina/repos","events_url":"https://api.github.com/users/sindarina/events{/privacy}","received_events_url":"https://api.github.com/users/sindarina/received_events","type":"User","site_admin":false},"created_at":"2015-04-27T17:52:44Z","updated_at":"2015-04-27T17:52:44Z","body":"No change on remaining issues, waiting a wee bit longer."}}