Forum Discussion

BT_90520's avatar
BT_90520
Icon for Nimbostratus rankNimbostratus
Sep 20, 2011

New web attack on SSL/TLS using BEAST

Hi there,     In the link below, the POC mentioned injecting the js thru use of an iframe ad or just loading the BEAST js into browser, thereafter comes the second stage of sniffing and decrypti...
app sec
BIG-IP Access Policy Manager (APM)
security
JRahm's avatar
JRahm
Icon for Admin rankAdmin
Oct 20, 2011
non-CBC ciphers are not vulnerable, so you can mitigate by updating your SSL profiles to eliminate CBC and use something like RC4-sha (widely supported).