I recently noticed that the SSL certificate of https://www.beppegrillo.it had expired.
It made me curious because that website is one of the most visited in Italy, and it seemed strange that in the span of 5 days nobody had been outraged about having to enter a password over a cleartext connection (example).
Also because the figure of speech “m.” is imminent: betas or candidate releases of modern browsers show explicit warnings wherever a password is requested over an unencrypted connection. See for example https://blog.mozilla.org/tanvi/2016/01/28/no-more-passwords-over-http-please/
Last night I pointed it out to Paolo Attivissimo via Twitter:
@disinformatico Son già 5 giorni che il certificato SSL di https://t.co/WdNBarkjim è scaduto, ma pare l'ho notato solo io… Mumble mumble.
— Fabrizio Carimati (@Clodo76) January 8, 2017
Shortly after, Paolo tweeted:
I grillini si vantano di essere quelli che capiscono Internet. Allora come mai il loro certificato SSL è scaduto da giorni? (via @clodo76) pic.twitter.com/pQ4Rw7omec
— Paolo Attivissimo (@disinformatico) January 8, 2017
I immediately clarified that a non-expired SSL certificate for the domain www.beppegrillo.it exists, but it is not configured on the relevant machine:
@disinformatico Quello su https://t.co/UUmrFMqyIb scade nel 2018 e copre tre domini tra cui https://t.co/S6SlyG1j4L. Mal configurazione?
— Fabrizio Carimati (@Clodo76) January 8, 2017
Claudio d’Angelis pointed out to me that the approach is not exactly professional, since normally the protocol should not determine the type of content, whereas it seems clear that the blog is necessarily in the clear, and encryption is reserved for something else (I do not know more; I have never frequented Grillo’s site).
.@disinformatico probabilmente perche' il sito e' gestito dal "nipote che smanetta" di turno che non ha la minima idea di cosa stia facendo pic.twitter.com/eV1m4YYTdM
— claudio d'angelis (@daw985) January 8, 2017
At that point I investigated (big word…) another 5 minutes (not even), and noticed that the web server responds providing information about the installed Apache version
@daw985 @disinformatico Porta pure a un 404. Ahi, non è vecchiotto Apache/2.2.15? … pic.twitter.com/o59Rb8e9pI
— Fabrizio Carimati (@Clodo76) January 8, 2017
Not that this is serious in itself, but usually professionals avoid providing this kind of info to make vulnerability research at least a bit harder.
A quick check on SSL-Labs highlighted known vulnerabilities (POODLE), weak ciphers and various other issues.
@daw985 @disinformatico Vabbè ma è un colabrodo … https://t.co/c0vTycG7nj è come sparare sulla croce rossa.
— Fabrizio Carimati (@Clodo76) January 8, 2017
Predictable with an Apache 2.2.15, which is a bit old. POODLE also confirmed by Comodo’s online scan.
@daw985 @disinformatico https://t.co/e3hZEQFIRD è pure vulnerabile al POODLE Attack, roba del 2014…
— Fabrizio Carimati (@Clodo76) January 8, 2017
More than one person on Twitter notes that the Movimento’s management site is on another machine, https://rousseau.movimento5stelle.it/ , which at a first glance seems well configured.
But objectively in this field you do not abandon something obsolete without updates just because it is obsolete, also because if that access has remote-code-execution vulnerabilities, that means access to the entire machine (and possibly to the related database).
And here we get to the reason for this summary.
I want to make clear that I used the term colander because the situation is evident, but I have NEVER said that it is a serious situation.
I consider myself a professional in my field (IT security), but here I have always stayed at the level of bar talk.
Establishing the severity of neglect would require a more accurate analysis, penetration testing, private notifications, agreed disclosure etc.
It could even be that the machine in question is only an empty reverse proxy or a load balancer to a better-configured backend machine, for example.
Estote parati! (@lastknight docet)
(Later edited to correct my Italian…)