weak https-Security in Windows 8 Mobile Browser (IE Mobile)

Hello Community & IE Developers


I have found out recently that IE Mobile does not meet some of the current Security Recommendations for Webbrowsers concerning https "improved Security with TLS". Maybe many others already have found this out,

but MS obviously did not yet consider it being at least worth a Fix or Update on Windows 8 Mobile...


Although the Browser already supports TLS 1.2 , there are some non-mitigated / unfixed Issues .

When testing it against the Qualys Labs SSL Browser Testing Site, it reports that


- SSLv3 ist still activated (therefor it is vulnerable for POODLE Attacks, which should be considered meanwile being a "laissez-faire" or Major Issue, which means leaving this Protocol ON puts encrypted Traffic using it at high Risk when intercepted by a MITM Connection Compromising Attempt). Same problem persists with non-mitigated TLS1.0 btw.


Furthermore,

- its DH Keys are not only selected ones but still includes weak export grades (therefor it is vulnerable for LOGJAM Attacks, which can be tested on weakdh.org)

- it accepts RSA_EXPORT grade keys for encryption which is weak and insecure because of low key Length

testing with freakattack.com shows Vulnerability

- uses RC4 with RSA (rc4.serverhello.com reports VULNERABLE with TLS_RSA_w_RC4_128_SHA Suites)

(RC4 announced off by the RFC for being weak and insecure, along with MD5 and everything else that is weaker)



Kind Regards.


Bernd P, Bavaria Nuernberg, Germany

Weiterlesen...