For more information regarding the security incident at F5, the actions we are taking to address it, and our ongoing efforts to protect our customers, click here.

Forum Discussion

BT_90520's avatar
BT_90520
Icon for Nimbostratus rankNimbostratus
Sep 20, 2011

New web attack on SSL/TLS using BEAST

Hi there,     In the link below, the POC mentioned injecting the js thru use of an iframe ad or just loading the BEAST js into browser, thereafter comes the second stage of sniffing and decrypti...
app sec
BIG-IP Access Policy Manager (APM)
security
BAMcHenry's avatar
BAMcHenry
Ret. Employee
Sep 22, 2011
Mitigating the initial attack vector, which is a combination of XSS and CSRF is the best bet. BIG-IP v11 does support TLS1.2. However, I do not think that FireFox, Safari, or Chrome support TLS 1.2 yet. And on Windows, only Vista/7 with IE8+ support TLS 1.2. So, there's a very large portion of the Internet population unable to access any site that moved forward with enforcing TLS1.2-only right now.