Missing Fallback Signaling Cipher Suite Value

TLS are usually implemented with legacy servers because they do not rely on the TLS protocol version negotiation mechanism. They will reconnect using a downgraded protocol, if the first handshake attempt fails. There are servers that does not support Fallback Signaling Cipher Suite Value. This helps to prevent man in the middle attacker. This attack focuses on using SSL/TLS protocol downgrade attacks. This causes loss of sensitive information.

Impact

The major impact include:-

• Man in the middle attack

Mitigation / Precaution

This vulnerability can be fixed by:-

• Removing all backward compatibilities.
• Implementing fallback scsv.

Written by

Nash N Sulthan

Cyber Security Lead Engineer