Any latest on this please?

Still the same on firefox, google chrome not secure! It's seem BT haven't fixed it.

In reply to a post by adslmax:

Any latest on this please?

Still the same on firefox, google chrome not secure! It's seem BT haven't fixed it.

IE and Edge also says its not secure in their console via the development tools section.

As for anything being done yet.

Nope, no change, I know I was at one point in contact with BT over this.

BT have also told me notifying the Chairman's Office wouldn't solve anything due to it would get forwarded to the same Security Team.

So they now have until the 6th to resolve the issue or I will send those emails.

Maybe they are commissioning a new server and we all know how long BT takes to commission stuff don't we

As to the state of that actual server, we already know that it hasn't had any security updates for at least several years, so the OS its using is also probably out of date too and where some of the security updates can and do require an up to date version of the OS.

So what started as just a security update now requires a full OS upgrade, might just be better to install a new server install all the required software etc and once completed just swap them over, and job done.

Paul

Perhaps it isn't a big issue from their perspective. Maybe it doesn't matter to them that it is insecure. Not knowing how they have it setup it may be a standalone server with no actual sensitive data on it and it could be sitting in it's own firewalled DMZ with NAC/NAP protecting the network. If they install it that way then whilst someone could compromise that server they wouldn't be able to do anything particularly significant.

Now, chances are it isn't like that and there are probably other servers in that DMZ and it may have a connection back to a database in the core network - but you cannot assume that is definitely the case.

Also, they may have a large number of IT projects in train and may have to prioritise which ones they are working on - therefore depending on the level of risk this may just not be top of the list.

Or just withdraw it from public availability.

For which none if us would thank the complainers. All the site sees from me is my IP address, just like any other. Incidentally I'm getting no objection from IE 11 on Windows 10 on two machines, one with Kaspersky and one with Norton, or Safari on an iPad.

It appears that CPs may be able to get further information via an account-related entry point. Those CPs one would expect to be entering on a more secure login.
...
BT Wholesale login is indeed https.

Edited by RobertoS (Wed 01-Mar-17 10:29:45)

In reply to a post by RobertoS:

Or just withdraw it from public availability.

For which none if us would thank the complainers. All the site sees from me is my IP address, just like any other. Incidentally I'm getting no objection from IE 11 on Windows 10 on two machines, one with Kaspersky and one with Norton, or Safari on an iPad.

IE and Edge on Windows 10 does moan about it, but not a on the main screen, to see the warning message you need to go into the "F12 Developer Tools" section and then the "Console Tab" then refresh the page an you will see it pop up on the console window.

So Edge and IE are having the insecure issue as Chrome and Firefox, the only difference is that IE and Edge don't stop your browser.

In reply to a post by RobertoS:

It appears that CPs may be able to get further information via an account-related entry point. Those CPs one would expect to be entering on a more secure login.
...
BT Wholesale login is indeed https.

If they are accessing the same server then their login will be as insecure as everyone else's.
But I am sure they use a different sub domain for them to login, which might be a different server and use a different CERT.

But we are talking about BT here.

Paul

https://www.btwholesale.com/portalzone/login/forceLoadLogin.do
http://www.dslchecker.bt.com/adsl/adslchecker.welcome

In reply to a post by RobertoS:

Or just withdraw it from public availability.

Hope not. Max would get withdrawal.

It's a distinct possibility I'm afraid. Ten minutes work.

I'm quite worried by people on this forum pursuing the (non-)issue.

In reply to a post by RobertoS:

https://www.btwholesale.com/portalzone/login/forceLoadLogin.do
http://www.dslchecker.bt.com/adsl/adslchecker.welcome

Yeah, the wholesale site is using a good CERT, shown below:

[Connection]
Protocol: TLS 1.2
Key Exchange: ECDHE_RSA
Key Exchange Group: P-256
Cipher: AES_128_GCM

Signature hash algorithm: sha256 <-- This was the main issue on the dslchecker site where it was SHA1.
Public Key: RSA (2048 Bits)

So all good there.

The security of the server is rated as B because of the following:
This server supports weak Diffie-Hellman (DH) key exchange parameters. Grade capped to B.   MORE INFO »
This server accepts RC4 cipher, but only with older browsers. Grade capped to B.  MORE INFO »

RC4 on that server needs resolving, Cipher Suites needs tweaking along with some minor stuff, but apart from that the server isn't that bad.

So if they resolved the RC4 issue and the minor tweaks that server would be rated A.

Now would I use that server, I probably would, but I would disable all the non secure Cipher client side (if I haven't already) that would force them to use another one you and the server have available.

Paul

In reply to a post by Ignitionnet:

In reply to a post by RobertoS:

Or just withdraw it from public availability.

Hope not. Max would get withdrawal.

LOL

Paul