公司作PCI Compliance时，涉及一系列安全改进。

我就SSL的BEAST攻击作了安全增强，只允许RC4级的安全认证协议，而非常规默认的CBC MODE。

~~~~~~~~~~

简介如下：

 

Approximately one year ago Juliano Rizzo and Thai Duong (the so-called BEASTie Boys) discovered a way to break SSL Encryption by mean of their BEAST attack (Browser Exploit Against SSL/TLS).

Their attack exploited a design flaw of the SSL/TLS 1.0 protocols (or better of the CBC cipher-suites, such as AES and 3DES), allowing to decrypt an encrypted conversation by sniffing the traffic and injecting a known pattern in the encryption channel. At that time the research had a considerable impact, given the wide usage of SSL/TLS in millions of websites providing secure online services.

As TLS 1.2 was not vulnerable, it was told, when possible, to migrate to this version of the protocol, but since its adoption is still far from being common, it was suggested, as Google did, to use a cipher not involving CBC mode, as for instance RC4.

After one year, at the Ekoparty Conference in Argentina, the two researchers are going to unveil a new attack against SSL/TLS dubbed CRIME. Few details are currently available: the two researchers are not revealing exactly which feature of SSL/TLS is responsible for the CRIME Attack (except that the specific feature used in this attack has not been a major subject of security research until now). In any case the new attack works much like the BEAST attack: once they have a man-in-the-middle position on a given network, they can sniff HTTPS traffic and launch the attack.

The bad news is that all versions of TLS (including 1.2) are vulnerable, and is not dependant on the cipher-suite adopted. Furthermore, according to the few information available, the exploits uses JavaScript code to make the attack faster, but in theory it could work also with static HTML, by loading JavaScript into the victim’s browser from a separate site.

The good news is that, although both Mozilla Firefox and Google Chrome are vulnerable to the attack. the browser vendors have developed patches for the issue that will be released in the next few weeks.

~~~~~~~~~~

设置很简单，就在APACHE的SSL模块设置里增加以下语句：

 

SSLHonorCipherOrder On
SSLCipherSuite RC4-SHA:HIGH:!ADH

参考文档：

 

http://httpd.apache.org/docs/current/ssl/ssl_howto.html

http://serverfault.com/questions/415112/fixing-beast-vulnerability-on-apache-2-0-running-on-rhel-4

https://community.qualys.com/blogs/securitylabs/2011/10/17/mitigating-the-beast-attack-on-tls