[資安]TLS/SSL Weak Cipher Suites處理

其實弱點報告我看到TLS/SSL Sweet32 attack（TLS/SSL Sweet32 attack）跟TLS/SSL Weak Cipher Suites 是有點沒有太多頭緒要怎處理，因為相關的SSL有一點點多…

不過我是透過幾個方式來處理

1.直接關閉掉TLS1跟TLS1.1 這個我應該在另一篇文章[資安] 關閉TLS 1.0 2 3教學講過，另外就是你可以直接用nmap來測試一下，nmap真是好用的工具阿… (以前在hitcon聽台上講師在講其實當時沒啥太多感覺，真的遇到問題時才發現用它來測試漏洞真的簡單多了…幾乎一行搞定)

nmap -p 3389 --script ssl-enum-ciphers 127.0.0.1

你如果在windows可以裝zenmap，他就是圖形化的nmap而已，記得把上面ip換成你要測試的網址或是IP

測試後你可能可以發現如下

Starting Nmap 7.92 ( https://nmap.org ) at 2022-06-28 13:33 台北標準時間

Nmap scan report for XXXXXX (XXXXX)

Host is up (0.0020s latency).

PORT     STATE SERVICE

3389/tcp open  ms-wbt-server

| ssl-enum-ciphers: 
|   TLSv1.0: 
|     ciphers: 
|       TLS_RSA_WITH_AES_256_CBC_SHA (rsa 2048) - A
|       TLS_RSA_WITH_AES_128_CBC_SHA (rsa 2048) - A
|       TLS_RSA_WITH_3DES_EDE_CBC_SHA (rsa 2048) - C
|       TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA (secp384r1) - A
|       TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA (ecdh_x25519) - A
|     compressors: 
|       NULL
|     cipher preference: server
|     warnings: 
|       64-bit block cipher 3DES vulnerable to SWEET32 attack
|   TLSv1.1: 
|     ciphers: 
|       TLS_RSA_WITH_AES_256_CBC_SHA (rsa 2048) - A
|       TLS_RSA_WITH_AES_128_CBC_SHA (rsa 2048) - A
|       TLS_RSA_WITH_3DES_EDE_CBC_SHA (rsa 2048) - C
|       TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA (secp384r1) - A
|       TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA (ecdh_x25519) - A
|     compressors: 
|       NULL
|     cipher preference: server
|     warnings: 
|       64-bit block cipher 3DES vulnerable to SWEET32 attack
|   TLSv1.2: 
|     ciphers: 
|       TLS_RSA_WITH_AES_256_GCM_SHA384 (rsa 2048) - A
|       TLS_RSA_WITH_AES_128_GCM_SHA256 (rsa 2048) - A
|       TLS_RSA_WITH_AES_256_CBC_SHA256 (rsa 2048) - A
|       TLS_RSA_WITH_AES_128_CBC_SHA256 (rsa 2048) - A
|       TLS_RSA_WITH_AES_256_CBC_SHA (rsa 2048) - A
|       TLS_RSA_WITH_AES_128_CBC_SHA (rsa 2048) - A
|       TLS_RSA_WITH_3DES_EDE_CBC_SHA (rsa 2048) - C
|       TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 (secp384r1) - A
|       TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256 (ecdh_x25519) - A
|       TLS_DHE_RSA_WITH_AES_256_GCM_SHA384 (dh 2048) - A
|       TLS_DHE_RSA_WITH_AES_128_GCM_SHA256 (dh 2048) - A
|       TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384 (secp384r1) - A
|       TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256 (ecdh_x25519) - A
|       TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA (secp384r1) - A
|       TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA (ecdh_x25519) - A
|     compressors: 
|       NULL
|     cipher preference: server
|     warnings: 
|       64-bit block cipher 3DES vulnerable to SWEET32 attack
|_  least strength: C

可以看到最後平等是寫least strength: C 因為上面有些選項不是A

接下來就是開始修補了，修補的方式有很多種，有可以去regedit去關閉一些相關的機碼之類的，或是直接乾脆用軟體一鍵搞定… 推薦好用的 Windows Cipher Suit 設定工具 – IISCrypto，這套軟體真的讚