Cipher suites still showing up at open

[kylel]

Good day,

I do not know if this is a false positive or not but i had done my initial scans across my domain servers and found old cipher suites still active. I went ahead and removed them from registry and anywhere else i could find but they still show as enable with scanning. The main one i am concerned with is SSL/TSL SWEET32 vulnerability. I have disabled all SSL and TLS1.0/1.1 as well as the associated ciphers such as Triple DES and RC4, yet the scan still comes up with these entries along with medium entries saying TLS1.0/1.1 are still open.

Any tips with this would be helpful,

Thank you.

[cfi]

A similar question has been already answered just half an hour ago which i’m linking below.

In the specific case it is probably also a 3rdparty / specific service which doesn’t evaluate / use the modification from e.g. the registry.

Invalid cipher detection (SWEET32)

You can get the full output which ciphers have been enumerated (which is the base for the VT in question) in the result of the following VT in your report (you need to update your filter to show “Log” level results accordingly): Name: SSL/TLS: Report Supported Cipher Suites OID: 1.3.6.1.4.1.25623.1.0.802067 As i haven’t seen any false reporting of the supported ciphers in all these years (the enumeration should be quite reliable as it looks for a specific hex string the server is choosing in …

[kylel]

wow i completely missed that.