Hello and welcome to the Friday, June 2nd, 2020,

edition of the Sands and its Stormsunters Stormcast.

My name is Johannes Ulrich, and today I'm recording from Jacksonville, Florida.

SSL version 2, I think it wasn't supposed to be used anymore around sort of Y2K.

That's sort of when some obvious vulnerabilities became known in SL version 2,

and it started to be removed from server configurations.

And yes, I'm talking about SL version 2, not version 3,

which of course hang around a little bit longer.

So Jan looked into, well, how much SL version 2 is?

They're still around and turns out there is still a little bit around.

Not a lot really sort of in the 1% kind of range.

We still have SL version 2, probably mostly sort of in the one percentage kind of range, we still have SL version 2, probably mostly

sort of legacy systems, IoT devices, and probably a lot of devices also that people just

have totally forgotten about.

Kind of amazing that they stayed alive that long.

And well, that's really live in IT as Jan explains as well here that there are some of

these vulnerabilities that are just sticking around forever.

And should you run across a web server that only supports SL version 2, then you may actually

have a difficult time connecting to it, because SL version 2 is no longer included as an option

in modern TLS implementations. But let's move on from 25 plus year year-old vulnerabilities to some newer issues.

Kaspersky published a blog post with details regarding new iOS matter that they have observed

installed on many different iOS devices in Russia.

...