Jump to content


Security issues with WoT client SSL - Needs updating.


  • Please log in to reply
7 replies to this topic

Dands #1 Posted Apr 17 2018 - 11:25

    First lieutenant

  • Beta Testers
  • 11235 battles
  • 903
  • Member since:
    08-03-2010

Dear Wargaming,

 

I have a new network router. A TP-Link C3150. Upon launching the WoT game my router crashes.  I have raised a ticket with TP-Link support and they have advised your WoT client uses an old / outdated / compromised version of SSL to protect my username and password when I start the game.

 

It would be a good idea, in fact it should be a high priority to use TLS 1.2 or later ASAP.

 

My router is crashing because the inbuilt protection is sensing this old version and protecting itself.

 

Please fix ASAP.

 

Thanks.

 

https://blog.pcisecu...o-ssl-early-tls


Edited by Dands, Apr 17 2018 - 11:27.


Pipinghot #2 Posted Apr 17 2018 - 12:16

    Major

  • Players
  • 25960 battles
  • 8,930
  • [IOC] IOC
  • Member since:
    11-20-2011

View PostDands, on Apr 17 2018 - 05:25, said:

My router is crashing because the inbuilt protection is sensing this old version and protecting itself.

No, your router is crashing because it's not using good error handling. If it was working properly it might refuse the connection, but it definitely should not crash, that's the fault of the router software.

 

Mind you, it's true that WG should be updating to a newer, more secure protocol, but crashing is not the proper response to this issue.


Edited by Pipinghot, Apr 17 2018 - 12:20.


Cognitive_Dissonance #3 Posted Apr 17 2018 - 13:05

    Major

  • Players
  • 40449 battles
  • 6,398
  • [ANASS] ANASS
  • Member since:
    01-31-2013

I too posted about the invalid SSL cert about 2 weeks ago. They really need to get this fixed, it is easy.

 

Call GoDaddy (or whomever), or log in to site. Renew cert, pay $200, download cert, install. viola!!

 

 



Cognitive_Dissonance #4 Posted Apr 17 2018 - 13:07

    Major

  • Players
  • 40449 battles
  • 6,398
  • [ANASS] ANASS
  • Member since:
    01-31-2013

View PostPipinghot, on Apr 17 2018 - 05:16, said:

No, your router is crashing because it's not using good error handling. If it was working properly it might refuse the connection, but it definitely should not crash, that's the fault of the router software.

 

Mind you, it's true that WG should be updating to a newer, more secure protocol, but crashing is not the proper response to this issue.

 

Ummm Mehbe, but the way I have Firefox setup (at work), it actually refuses to let you access sites that are running older TLS versions. So while I find a router crashing odd, you can have settings to block such a site. Plus our firewall will block access to such sites - but of course we are talking an ASA-5545X running FirePOWER, so there is that.

BabA_YA6A #5 Posted Apr 17 2018 - 14:41

    Captain

  • Players
  • 26287 battles
  • 1,244
  • [O-VER] O-VER
  • Member since:
    08-09-2013

View PostPipinghot, on Apr 17 2018 - 05:16, said:

No, your router is crashing because it's not using good error handling. If it was working properly it might refuse the connection, but it definitely should not crash, that's the fault of the router software.

 

Mind you, it's true that WG should be updating to a newer, more secure protocol, but crashing is not the proper response to this issue.

 

+1 Smile_great.gif

Pipinghot #6 Posted Apr 17 2018 - 17:31

    Major

  • Players
  • 25960 battles
  • 8,930
  • [IOC] IOC
  • Member since:
    11-20-2011

View PostCognitive_Dissonance, on Apr 17 2018 - 07:07, said:

View PostPipinghot, on Apr 17 2018 - 05:16, said:

No, your router is crashing because it's not using good error handling. If it was working properly it might refuse the connection, but it definitely should not crash, that's the fault of the router software.

 

Mind you, it's true that WG should be updating to a newer, more secure protocol, but crashing is not the proper response to this issue.

Ummm Mehbe, but the way I have Firefox setup (at work), it actually refuses to let you access sites that are running older TLS versions. So while I find a router crashing odd, you can have settings to block such a site. Plus our firewall will block access to such sites - but of course we are talking an ASA-5545X running FirePOWER, so there is that.

You've just proven my point. You have Firefox set up to refuse access to sites that are running older TLS, but Firefox doesn't crash every time you try it, because Firefox is doing proper error handling and simply refuses access. Any router that crashes because of an older protocol is just wrong.



Dands #7 Posted Apr 17 2018 - 23:57

    First lieutenant

  • Beta Testers
  • 11235 battles
  • 903
  • Member since:
    08-03-2010

View PostPipinghot, on Apr 17 2018 - 21:16, said:

No, your router is crashing because it's not using good error handling. If it was working properly it might refuse the connection, but it definitely should not crash, that's the fault of the router software.

 

Mind you, it's true that WG should be updating to a newer, more secure protocol, but crashing is not the proper response to this issue.

 

I can follow your thinking and agree. I did raise a ticket and TP-Link support were great.

Pipinghot #8 Posted Apr 18 2018 - 03:37

    Major

  • Players
  • 25960 battles
  • 8,930
  • [IOC] IOC
  • Member since:
    11-20-2011

View PostDands, on Apr 17 2018 - 17:57, said:

I can follow your thinking and agree. I did raise a ticket and TP-Link support were great.

Cool beans, glad to hear they were responsive. Have fingers crossed for you (and all TP-Link) owners that they'll provide a firmware patch quickly.






1 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users