Hello, welcome to the Tuesday, June 28, 2022 edition of the Sands and at Storm Center's Stormcast. My name is Johannes Ulrich, and I'm recording from Stockholm, Germany.

Today, I took a little bit of closer look at an emerging standard. It's actually an IATF draft officially at this point, encrypted client

hellos. The first data packet being sent by a client to a server in order to negotiate a TLS

connection is the client hello. And it has been sort of the weak point of TLS privacy in many ways. First of all, the server name is usually passed along

in the clear. Now, there was an earlier standard that just encrypted the server name

indication field, which is the server name. That standard hasn't really taken off and actually sort of has been

deprecated in favor of encrypting the entire most of the declined hello, which also avoids

some fingerprinting issues. Now, one question I was wondering is, is anybody actually using it? There are a couple

browsers that at least have the option to implement it. And what I noticed is the DNS record

that goes with this feature. There are actually two sort of specific DNS records that were

introduced for this feature.

One in particular, HDPS is a DNS resource record type that is sort of used for encrypted client.

I noticed that clients actually sent the record, but so far I don't see any servers actually responding and supporting

it, which then of course means it falls back to the good old way to do client hellos.

Now, these emerging standards, of course, will affect the efficacy of your network monitoring

solutions, and that's why you definitely should keep an eye on

whether or not these standards are being used in the network, and whether or not you may be

missing some data if you no longer can, for example, pull host names out of these client hellos.

And of course, as usual, more details in the post.

And Jenkins released an update fixing a number of different vulnerabilities.

Many of them cross-ed scripting, some CS-serve vulnerabilities, but also, for example,

a few plugins that do store credentials like passwords in the clear. Most of the vulnerabilities

...