[Update: GlobalSign uses Qualys SSL Labs for its testing, so while both are referenced, they are actually conducting the same test. A subsequent third test, independent of the other two, finds the same vulnerability.]
[Update II: The City Manager responds: He has asked the IT director to review.]
GREENSBORO, NC -- Computer security engineers announced the discover of the "Heartbleed Bug" this week, a computer code vulnerability that can expose information encrypted with the SSL/TLS protocol. This protocol is used to protect passwords and account numbers in web browsers, apps, email and instant messaging.
While wildly deployed, the vulnerability is not universal. It occurs with certain server configurations. There are online tools that will allow you to check an internet domain to see if it is susceptible to the Heartbleed Bug. Here are two:
Qualys SSL Labs
GlobalSign
I tested a few local sites that use encryption for online payments. None were vulnerable to the Heartbleed bug. However, the City of Greensboro's encryption certificate installation for secure.greensboro-nc.gov, where the city accepts online payments for fees ranging from parking tickets to street performer licenses, got an F from both testers.
I am not knowledgeable enough to fully explain the reasons for these scores, but it appears as if there are a few areas of weakness, the most egregious being because the city allows its encryption certificates to use the older SSL2 protocol (in addition to newer ones) that the testing sites label as "insecure." Indeed, there to appear to be a number of vulnerabilities for that protocol, including vulnerability to "man in the middle" attacks where it would seem to the user as if everything is operating normally, but where information is being secretly intercepted by an uninvolved third party.
I've alerted the city of this problem and will post any replies I receive.
No comments:
Post a Comment