It has been a busy week for Qualys at Black Hat in Las Vegas. Earlier in the week the company announced the ability to include “exploitability data” its QualysGuard product. On Wednesday, the company announced the launch of “BlindElephant” – an opensource tool for Web application fingerprinting.
Today, Qualys announced a free online SSL test, which examines a Web site’s SSL certificate and performs a configuration analysis to detect configuration weaknesses and performance issues. Users enter the web site domain name, and the test will assess any server behind the domain. The test results include a numerical score, grading the SSL server across several categories, as well as a letter grade that rates the SSL configuration.
A numerical score from zero to 100 and a letter grade is provided at the end of the test indicating the strength of the SSL implementation on the web site being tested. We ran the test on several popular domains and it dished out some pretty harsh grades. For example, bankofamerica.com servers scores ranged from 48 to 63. Are Bank of America’s SSL certificates really configured that poorly?
Along with the launch, the findings of research conducted over the past year studying about 120 million registered domain names using more than 800,000 SSL certificates will be presented in a live session today at Black Hat USA 2010.
SSL can often have issues, including problems with configurations and certificate validations, which render SSL useless and jeopardize online security.
Some interesting statistics on SSL:
• Only a tiny portion of all sites use SSL
• Only 70 percent of certificates are valid • Half of all sites support the insecure SSLv2 protocol
• About 38 percent of SSL sites are well configured; 62 percent are not
• About 32 percent of sites still suffer from the renegotiation vulnerability
“SSL is a successful protocol that serves as the security backbone of the Internet, but most sites just don’t have it well configured,” said Ivan Ristic, director of engineering for Qualys and creator of SSL Labs.
To use the SSL testing tool, visit: https://www.ssllabs.com/