• 0 Posts
  • 24 Comments
Joined 1 year ago
cake
Cake day: June 23rd, 2023

help-circle








  • $previous_job allowed us to pick. One of my coworkers had to replace his laptop, and I convinced him to try out Linux this time. I handed him the bootstrap script and he was back to working by the afternoon.

    Our CEO got wind of this and said as a matter of policy everyone is switching to Linux unless they have a good reason (needing excel for financial reports is a good reason). The two new hires who had been setting up their dev environment for over a week at that point were the trigger for this.







  • Also that in order to exploit this it requires an active man in the middle. Which requires any of the following:

    • Reverse proxy hijack/NAT hijack - from a compromised machine near the server
    • BGP hijack - stealing traffic to the real IP
    • DNS hijack - stealing traffic to send to a different IP
    • Malicious/compromised network transit
    • Local network gateway control
    • WAP poisoning - wifi roaming is designed really well so this is actually easier than it sounds.

    Almost all of those have decent mitigations like 801.x and BGP monitoring. The best mitigation is that you can just change your client config to disable those ciphersuites though.