How we secure Apache and Nginx web servers from SWEET32 bug If your servers are running vulnerable versions, you should disable these weak ciphers without delay.

Though OpenSSL has disabled support for weak ciphers from version 1.1.0 release onwards, we’ve seen many servers still running older versions that are vulnerable.įor the servers that we manage, our expert technicians keep all server software updated, to protect them from attacks. For enhanced security, we allow only strong ciphers such as AES. To secure the confidential information from this critical SWEET32 birthday attack vulnerability, we disable all 64-bit block weak ciphers. These are the ones we disable for server security. To examine the ciphers that are enabled in the OpenSSL server, we use the ‘nmap’ command. The code ‘ 3DES’ indicate cipher suites that use triple DES encryption. The first thing we do, is check the version of OpenSSL server: ~ $ openssl version If your servers are running OpenSSL versions prior to 1.0.1, which cannot support strong ciphers, your servers are already vulnerable to many other attacks too, such as CCS Injection Vulnerability. uses OpenSSL with the vulnerable ‘Triple-DES’ cipher support, your server is susceptible to attack. OpenSSL protocol uses the vulnerable ‘Triple-DES’ ciphers for encrypting the data. So if your web servers such as Apache, NginX, etc.

Once there’s a match, sensitive data can be decrypted by determining how the key was chosen.Īre your servers vulnerable to SWEET32 attack?.

Attacker sends dummy data to your server until a key used for a customer matches the attacker’s session key.

The attacker sniffs all data sent to your customer.

These keys are chosen randomly, and the probability of any two customers getting the same key is very low.īy misusing the SWEET32 vulnerability, an attacker can send in large volume of dummy data, and get blocks of cipher text that matches that of a customer. The web server encrypts data using cryptographic keys. Hackers can then easily decrypt your valuable data using a method called Birthday Attack. Here’s how it works: This makes HTTPS connections in those servers vulnerable to this SWEET32 bug.

See how we secure your servers! What is SWEET32 Birthday Attack?īy default, servers have ‘ 3DES-CBC’ cipher enabled in TLS. “SSL/TLS server supports short block sizes (SWEET32 attack)” If you see that your website is failing security scans with this message, that means your server is vulnerable to SWEET32 attacks. By exploiting a weak cipher ‘ 3DES-CBC’ in TLS encryption, this bug has caused many server owners to panic about their data security. In our role as hosting support engineers for web hosts, we perform periodic security scans and updates in servers to protect them from hacks.Ī recent bug that affects the servers is the SWEET32 vulnerability. Over 80% websites in the internet are vulnerable to hacks and attacks.

Waves ssl 4000 for windows 10 magesy