Protocol Hurts Hardware

Tuesday, February 28, 2017 @ 05:02 PM gHale


Devices running the Chrome web browser or Chrome OS appear to have a poor implementation of the TLS 1.3 protocol which created problems for users of Symantec’s Blue Coat.

Google said the use of Blue Coat proxies causes connection problems when Chrome 56 or Chrome OS 56 attempt to connect via TLS 1.3.

RELATED STORIES
Java, Python FTP Injection Hole
New, Improved RAT on Prowl
Reviewing Latest Shamoon Attacks
OpenSSL Vulnerability Patched

Google said the issue affects products running version 6.5 of the Blue Coat SGOS operating system.

An employee of Montgomery County Public Schools in Maryland reported that thousands of the organization’s Chromebooks and PCs had broken down due to the bug. The affected devices had automatically updated to Chrome OS 56, respectively Chrome 56, which introduce support for TLS 1.3.

The employee said the organization’s Chromebooks are “stuck in a state of flickering between a login screen and a ‘Network not available’ screen. Occasionally, you can see a SSL_HANDSHAKE_ERROR briefly at the login screen before switching back to the ‘Network not available’ screen.”

Other major education organizations suffer from the issue as well, likely because SSL/TLS inspection is common in this sector, Google said in a post.

The company created workarounds and released a Chrome update that disables TLS 1.3. A future version of the web browser will re-enable TLS 1.3.

Blue Coat is aware of the TLS 1.3 issue several months ago, Google said.

TLS 1.3 is still under development, but a final version should be out soon.



Leave a Reply

You must be logged in to post a comment.