SSL 3.0 Protocol Vulnerability and POODLE Attack

All systems and applications utilizing the Secure Socket Layer (SSL) 3.0 with cipher-block chaining (CBC) mode ciphers may be vulnerable. However, the POODLE (Padding Oracle On Downgraded Legacy Encryption) attack demonstrates this vulnerability using web browsers and web servers, which is one of the most likely exploitation scenarios. This affects most current browsers and websites, but also includes any software that either references a vulnerable SSL/TLS library (OpenSSL) or implements the SSL/TLS protocol suite itself. By exploiting this vulnerability in a likely web-based scenario, an attacker can gain access to sensitive data passed within the encrypted web session, such as passwords, cookies and other authentication tokens that can then be used to gain more complete access to a website.

We highly recommend disabling SSL 3.0 as well as SSL 2.0 if applicable.

To disable SSL 2.0/3.0 in IIS 6 or IIS 7:

1. Click Start, click Run, type regedit, and then click OK.
2. In Registry Editor, locate the following registry key/folder:
HKey_Local_Machine\System\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols
3. Right-click on the SSL 2.0 folder and select New and then click Key. Name the new folder Server.
4. Inside the Server folder, click the Edit menu, select New, and click DWORD (32-bit) Value.
5. Enter Enabled as the name and hit Enter.
6. Ensure that it shows 0x00000000 (0) under the Data column (it should by default). If it doesn't, right-click and select Modify and enter 0 as the Value data.
7. Now to disable SSL 3.0, right-click on the SSL 3.0 folder and select New and then click Key. Name the new folder Server.
8. Inside the Server folder, click the Edit menu, select New, and click DWORD (32-bit) Value.
9. Enter Enabled as the name and hit Enter.
10. Ensure that it shows 0x00000000 (0) under the Data column (it should by default). If it doesn't, right-click and select Modify and enter 0 as the Value data.
11. Restart the computer.


This process is the same for IIS 6 (Windows Server 2003) machines. The server folder under SSL 2.0/SSL 3.0 will already be created so you will only need to create a new DWORD value under it and name it Enabled.

To disable SSL 3.0 in IIS 8 (Windows Server 2012):

1. In the Search menu type regedit.exe
2. Right-click on regedit.exe and click Run as Administrator
3. In the registry editor go to HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\Schannel\Protocols\
4. In the navigation tree, right-click on Protocols, and in the pop-up menu, click New > Key. Name the key SSL 3.0.
5. In the navigation tree, right-click on the new SSL 3.0 key that you just created, and in the pop-up menu, click New > Key. Name the key Client.
6. In the navigation tree, right-click on the new SSL 3.0 key again, and in the pop-up menu, click New > Key. Name the key Server.
7. n the navigation tree, under SSL 3.0, right-click on Client, and in the pop-up menu, click New > DWORD (32-bit) Value. Name the value DisabledByDefault.
8. In the navigation tree, under SSL 3.0, select Client and then, in the right pane, double-click the DisabledByDefault DWORD value.
9. In the Edit DWORD (32-bit) Value window, in the Value Data box change the value to 1 and then, click OK.
10. In the navigation tree, under SSL 3.0, right-click on Server, and in the pop-up menu, click New > DWORD (32-bit) Value. Name the value Enabled.
11. In the navigation tree, under SSL 3.0, select Server and then, in the right pane, double-click the Enabled DWORD value.
12. In the Edit DWORD (32-bit) Value window, in the Value Data box leave the value at 0 and then, click OK.
13. Restart your Windows server.

Once you have disabled the protocols, you may test your server at www.poodlescan.com.

Where Threats Live

During the course of a day we sideline lots of bad guys. Some countries are more active than others, and not in a good way. Sign into the Dashboard to see the Top Threats to your server and the countries where they live.

CN	84,272	73.99%
US	3,696	3.24%
RU	3,584	3.15%
UA	3,392	2.98%
FR	2,992	2.63%
CA	2,032	1.78%
KR	1,808	1.59%
CZ	1,552	1.36%
HK	1,280	1.12%
BG	1,088	0.96%
TH	1,040	0.91%
RO	960	0.84%
JP	928	0.81%
TW	848	0.74%
TR	752	0.66%
NL	576	0.51%
VN	528	0.46%
DE	320	0.28%
CH	272	0.24%
BR	192	0.17%
BY	128	0.11%
EC	128	0.11%
AL	112	0.1%
AE	96	0.08%
GB	96	0.08%
PL	96	0.08%
SE	80	0.07%
MD	80	0.07%
IN	80	0.07%
IL	64	0.06%
EU	48	0.04%
IR	48	0.04%
ID	48	0.04%
A1	48	0.04%
BZ	48	0.04%
PH	48	0.04%
SA	48	0.04%
SG	32	0.03%
PA	32	0.03%
MT	32	0.03%
MU	32	0.03%
AT	32	0.03%
IT	32	0.03%
ME	16	0.01%
MN	16	0.01%
IE	16	0.01%
GH	16	0.01%
ES	16	0.01%
CO	16	0.01%
AU	16	0.01%

404 Error Could Be Your DNS Cache

Overview

Your DNS cache stores the locations (IP addresses) of webservers that contain pages which you have recently viewed. If the location of the web server changes before the entry in your DNS cache updates, you will be unable to access the site. If you encounter a large number of HTML 404 error codes, you may need to clear your DNS cache. This will force your local computer to request new DNS information from its assigned nameservers rather than pull previously retrieved information from its local resolver cache.

How To Clear Your DNS Cache

The following methods allow you to remove old and inaccurate DNS information that may result in 404 errors.

Windows 8

1. Press Win+X to open the WinX Menu.
2. Right-click on Command Prompt and select Run as Administrator.
3. Type the following command and press Enter:

   ipconfig /flushdns

Windows 7

1. Click the Start button.
2. Enter cmd in the Start menu search field.
3. Right-click on Command Prompt and select Run as Administrator.
4. Type the following command and press Enter:

   ipconfig /flushdns

Windows XP, 2000, or Vista

1. Click the Start button.
2. On the Start menu, click Run....
3. If you do not see the Run command in Vista, enter run in the Search bar.
4. Type the following command in the Run text box:

   ipconfig /flushdns

MacOS 10.7 and 10.8

1. Click Applications.
2. Click Utilities.
3. Double-click the Terminal application.
4. Type the following command:

   sudo killall -HUP mDNSResponder

MacOS 10.5 and 10.6

1. Click Applications.
2. Click Utilities.
3. Double-click the Terminal application.
4. Type the following command:

   sudo dscacheutil -flushcache

Once you clear your DNS cache, your local computer will query its nameservers and begin using newly changed information.

How to Setup and Configure the SMTP Service for Windows Server 2012

Many applications depend on the internal Windows SMTP Service to relay email confirmations to visitors browsing their web site. When using Windows Server 2012 the SMTP feature must be installed and configured first. Below are the steps for installing the internal Windows SMTP Service.

Install the SMTP Service

1 Launch the Server Manager.

2 From the Dashboard, click on Add Roles and Features to begin the wizard. Click Next on the first screen.

3 Select 'Role-based or feature-based installation'.

4 Select the server.

5 Click Next to bypass the Roles selections.

6 Scroll down the list and tick the 'SMTP Server' feature.

7 A new window will pop up to inform you that some other services will also be installed. Click Add Features to confirm and continue.

8 Click Next to continue past the features selection screen.

9 Click Install to complete the installation.

10 Click Close when the installation has completed.

Configure the SMTP Service

1 Launch the Internet Information Services (IIS) 6.0 Manager.

2 Click Yes to the UAC Prompt.

3 Right-click on SMTP Virtual Server #1 and select Properties.

4 Select the General tab and change the IP Address to the server’s IP address.

5 Select the Access tab and click on the Connection button.

6 In the Connection window, select 'Only the list below' and click the Add button.

7Add the IP address, Group of computers or Domain of the devices permitted to use the internal SMTP, then click OK.

8 In the Access tab of the Connection window, click the Relay button. Add the same permitted devices to the Relay Restrictions list.

9 In the Delivery tab of the Connection window, set an external domain.

10 Launch the Windows Firewall with Advanced Security console.

11 Right-click on 'Inbound Rule' and select 'New Rule' to begin the wizard.

12 Select 'Port' and click Next.

13 Set the local port to 25 and click Next.

14 Choose 'Allow the connection' and click Next.

15 Uncheck 'Public' to prevent external access to the server. Click Next.

16 Give the rule a name, and click Finish.

17 You should now see a new rule enabled in the firewall management console.

18 In the Server Manager, click on Tools and select Services.

19 In the Services window, double-click on 'Simple Mail Transfer Protocol (SMTP)'.

20 Stop and then Start the service. Set the Startup type to Automatic.

20 Click OK to finish. The internal SMTP service is now ready and listening.

---

Remember to add this new SMTP server as a legitimate relay if your mail domain is using (SPF) Sender Policy Framework.

---

How to Prevent RDP Brute Force Attacks

Tech forums and publications are buzzing with news of a tool that enables hackers to attack servers via the Remote Desktop protocol (RDP), a commonly used protocol on remote servers that relies on enabling common ports to access them. These brute force attacks are nothing new, but the frequency of these attacks has sharply increased in recent months and are predicted to continue growing this year.

Understanding the Attacks

A brute force attack on the RDP server allows the attacker to connect. The attacks seem to follow a simple methodology:

• Scan a range of IP addresses.
• Scanner looks for open ports usually used by RDP (e.g. 3389).
• A RDP brute force attack is launched using dictionary terms.

Successful logins by the attacker will give them access to the drives of that server (via the shares \\tsclient\c and \\tsclient\d). This may give the attacker access to the server, potentially including areas usually hidden from the external connection, such as local backups and development areas.

There are no reports of successful breaches yet, so it's unknown what motives are behind the attacks. Similar attacks in the past suggest that infected servers could be used to launch stronger attacks and thus scatter and strengthen itself. However, it could also be used to install other malware or ransomware.

With this type of attack, Windows 2003 servers could also be affected by memory exhaustion which would cause them to reboot. It could also cause Window 2008+ servers to fill their log files. However, this type of attack is not only aimed at Windows servers — it is an IP based attack.

Preventing the Attacks

As with any emerging threat, there are precautions that those running RDP on their servers can take.

• Use strong passwords for your RDP sessions including:
  • One or more special characters such as !@#$%^&*()
  • At least one number, preferably two or more
  • A mix of upper and lower case
  • At least 7 characters in length
  • A non-dictionary word
• Do not use standard usernames (root, admin, owner, test).
• Implement account lockout policy for a set number of failed logins before locking out the account.
• Use an alternative port instead of leaving RDP port 3389 open for anyone to abuse. To change this automatically, use Microsoft Fix It.
• Consider locking the RDP port to a specific IP address.
• On Windows 2008 (and server 2012), enable Network Level Authentication which means the session can not established until the credentials are authorized.
• Ensure you have all the latest patches installed.
• Have a plan to be proactive and scan for potential attacks.
• Limit RDP access to only the accounts that require it.
• If external access is needed, configure a VPN tunnel.

RDP is a great tool used by administrators and users alike to establish multiple connections to a system, but there's a risk if the connections and software aren't secure. Knowing how RDP works, why it’s being used, and what can be done to secure it will help administrators to get a better grasp on server security.