Yet Another Reason For Secure Websites

 

Thanks to the 25th Usenix Security Symposium the world has just discovered a flaw in the TCP implementation on Linux that has been around since 2012. Many, many websites run on Linux so this problem could very likely affect your own business website.

"Such a weakness could be used to launch targeted attacks that track users’ online activity, forcibly terminate a communication, hijack a conversation between hosts or degrade the privacy guarantee by anonymity networks such as Tor."

-UCR Today

The Good News

If your website is already hosted with us (https://ProfessionalWebsites.biz) then you have nothing to worry about, our servers have already been patched.

If your website is secure (https://) but hosted elsewhere you have less to worry about. The worst an attacker could do is reset a visitor's connection:

"Encrypted connections (e.g., HTTPS) are immune to data injection, but they are still subject to being forcefully terminated by the attacker."

-UCR Today

If your website is running on Linux (either https:// or http://) then you should contact your hosting provider to see if they have applied the temporary fix.

"This can be done on Ubuntu, for instance, as follows:

  1. Open /etc/sysctl.conf, append a command “net.ipv4.tcp_challenge_ack_limit = 999999999”.
  2. Use “sysctl -p” to update the configuration.

-UCR Today

Tip

The https://wappalyzer.com/ browser plugin may help you determine if your website is running on Linux.

Some Linux servers are reported as Unix and should be investigated:


unix

If your website is running on Windows this problem does not affect you.

windows.net

Related Articles

http://www.computerworld.com/article/3106284/security/use-the-internet-this-linux-flaw-could-open-you-up-to-attack.html 

How Secure Is Your Small Business Network?

A Word About Passwords

Save

Save

One thought on “Yet another reason for secure websites

Comments are closed.