Web-Performance Blog
MyIP.is, a handy online tool designed to instantly provide users with their public IP address and additional related information.
One of the cool features of this website is that they are actively involved in managing larger pages, collecting and analyzing IP data, and then compiling a list of malicious players on the web, which is available for free download.
Even as a long-time listener of the daily newscast from SANS Storm Center, I never knew they offer a free API with useful information. The downside is that the API is rather slow, but still useful for IP intelligence.
After a recent penetration test on an Azure website, I received a report stating that I need to disable CBC ciphers in my TLS configuration. I was able to reproduce the issue.
However, I found that on Azure Front Door Standard and Azure Front Door Premium, it’s not possible to configure the cipher order or the selection of ciphers. All of this is fully managed by Microsoft.
CVEMap is a user-friendly, open-source command-line interface (CLI) tool engineered for seamless exploration of Common Vulnerabilities and Exposures (CVEs). Its purpose is to provide a smooth and intuitive platform for delving into vulnerability databases. However, the tool relies on a free cloud service.
Before the World Economic Forum in January 2024 in Davos Switzerland, Chinese Premier Li Qiang arrived in Switzerland on Sunday and was officially received with military honors. On the same day, Ukrainian President Volodymyr Zelensky visited the Swiss Parliament Building in Bern. The World Economic Forum began in Davos on Monday. By Wednesday January 17th 2024, the first public reports appeared regarding DDoS attacks against websites in Switzerland, attributing them to the group NoName057(16).
It’s important to stay on top of new discoveries and vulnerabilities, following up on products. Knowing is the first step, evaluation and taking action is the second step.
Another crucial step is to sign up for security advisories with all your key vendors to significantly reduce the response time to newly released security advisories from the supplier.
I had to evaluate the risk of a potential Terrapin attack.
The Terrapin attack can target connections secured with ChaCha20-Poly1305 or CBC-mode ciphers with Encrypt-then-MAC. There is a theoretical vulnerability in CTR-mode ciphers combined with Encrypt-then-MAC, but it is not currently exploitable in real-world scenarios.
The attack requires an active Man-in-the-Middle.
OpenSSH and other vendors have implemented a strict key exchange countermeasure, but for it to be effective, both client and server must support it. Connecting a vulnerable client to a patched server, or vice versa, still results in a vulnerable connection.
This warning is present on all SharePoint and is designed to prevent people from being tricked into copying and pasting malicious code into the developer console of their browser.