I have inform BT about this. They say it all working fine, all fixed. But I don't think they never understand the dslchecker still not secure on firefox and google chrome.

Internet Explorer are working fine.

In reply to a post by adslmax:

I have inform BT about this. They say it all working fine, all fixed. But I don't think they never understand the dslchecker still not secure on firefox and google chrome.

Internet Explorer are working fine.

Yes IE and Edge do work fine, but if you open up the developer tools and check the console messages you will see the warning.

SEC7132: The certificate protecting this website uses weak cryptography (SHA1). The website should replace this certificate with an SHA2 certificate before SHA1 is no longer allowed.
www.dslchecker.bt.com

I have sent a very detailed email of the issue and what exploits they webservers are vulnerable to that could gain the attacker access to the server in question itself and then access to all the database servers that server has access to.

I have also told them they can contact me for more information if needed and also if this security blunder isn't resolved within a reasonable time I will be contacting the Chairman's office due to our private information like address and phone number, mu phone number is ex-directory and a hacker would have access to both information breaking the privacy act.

The sad thing is they have no clue what they are doing, they webserver is vulnerable to the SSL3 POODLE Exploit, if you are unaware of that exploit do a google search.

I am about to sent BT a tweet with an image of the vulnerable areas, maybe this approach will get it resolved.

*** update ***
Tweets sent.

Also its only the DSL Checker that is insecure with all the exploits, the main BT Site (i.e. https://home.bt.com) has a rating of A, its not perfect but its secure.

Lets now see what becomes of it
I bet I get told to remove my Tweets due to it exposes what its vulnerable to.

Paul

Edited by PaulKirby (Mon 20-Feb-17 20:09:56)

I post this to PN forum as someone deleted my post by PN staff. Disgusted because PN are the isp can report this to BTWholesale of dslchecker not secure.

I was surprise no one from many isp's can see this and doesn't want to get involved.

Edited by adslmax (Mon 20-Feb-17 22:20:18)

In reply to a post by adslmax:

I post this to PN forum as someone deleted my post by PN staff. Disgusted because PN are the isp can report this to BTWholesale of dslchecker not secure.

I was surprise no one from many isp's can see this and doesn't want to get involved.

Well that doesn't sound good

Well I am going to give BT 7 to 10 days to respond to my Email and Tweets and if nothing is heard I will be forwarding this to the chairman's office because the dsl checker is part of BT's network and should be responsible for keeping it secure like they do with their main site.

All it would take them to resolve the issues is about 20 mins if that.

One of the sites that I run which I including in one of the links use to be rated D to F when I was unaware of all the issues and after 20 to 30 mins of me not being a Linux Guy I now have it rated at A and A+.

So surely they tech people responsible to maintain those servers would have the knowledge to keep it up to date.

They are not even using the latest protocols and the ones they do have exploits or on their way out like TLS1.0

Maybe the tech people in question are the same support people that BT were currently using which are located overseas LOL

Paul

The certificate problem is the sha1 hash.

The ciphers used are independent of the certificate and is how their web server is configured.

There is more problems tho.

The ssl libraries have not been patched for over a year, so its vulnerable to things like POODLE, no forward secrecy support in mainstream browsers, no TLS 1.2 support, its preferred cipher is 3DES which was favoured in windows XP and IE6 days. As I said before typical of a large company, the server itself has probably been untouched for several years. It also still has sslv3 enabled.

Edited by Chrysalis (Tue 21-Feb-17 06:06:27)

In reply to a post by Chrysalis:

The certificate problem is the sha1 hash.

The ciphers used are independent of the certificate and is how their web server is configured.

There is more problems tho.

The ssl libraries have not been patched for over a year, so its vulnerable to things like POODLE, no forward secrecy support in mainstream browsers, no TLS 1.2 support, its preferred cipher is 3DES which was favoured in windows XP and IE6 days. As I said before typical of a large company, the server itself has probably been untouched for several years. It also still has sslv3 enabled.

Wasn't that was I already said in my posts, but yeah, I agree with them not touching their server for a long time.

OpenSSL has been patched many times over the last several years, theirs hasn't, the security status of SSL3 was posted many years ago and was advised to disable it and use TLS and newer versions of TLS like version TLSv1.2 and soon to be TLSv1.3, TLSv1.0 is on its way out due to some security issues.

The SHA1 (128 bit) has is insecure due to all hashes are known just like MD5 so that's why its throwing an issue with SHA1.

Well I have still yet to hear anything from my Email and any of my Tweets sent to various BT sections, even with physical evidence handed to them there has been no response as yet.

Also I think they are holding off until June because the Cert expires on Mon, 12 Jun 2017 23:59:59 UTC (expires in 3 months and 22 days) its still not right and they should still resolve the rest of the issue now.

Paul

Edited by PaulKirby (Tue 21-Feb-17 19:53:13)

I hope you sent them from a mobile data link, not your FTTP connection ....


[chuckle] LOL

In reply to a post by RobertoS:

I hope you sent them from a mobile data link, not your FTTP connection ....


[chuckle] LOL

LOL, you know what, my Sister said the exact same when I told her last night.

Paul

Yes, she and I agree on quite a lot.
.
.
.
.
.
.
.
.
.

MrSaffron should take this action against BT. But, I think he wouldn't bothered.