-1

I got this from my compliance check results.

To me it looks like my router is responding to their test but I'm not sure where to go . ( might be off track completely though)


Description: PCI DSS Compliance : Insecure Communication Has Been Detected

Synopsis: An insecure port, protocol or service has been detected.

Impact: Applications that fail to adequately encrypt network traffic using strong cryptography are at increased risk of being compromised and exposing cardholder data. If an attacker is able to exploit weak cryptographic processes, he/she may be able to gain control of an application or even gain clear-text access to encrypted data.

Data Received: The following web pages use Basic Authentication over an unencrypted channel :

/:/ realm="NETGEAR DG834G "

Resolution: Properly encrypt all authenticated and sensitive communications.


Their suggestion is to turn off World Wide Web Publishing Service. But this does not appear to be running in my services.

I tried a netstat on the pc but port 80 is not coming up. Can I do the same on my router somehow?

netstat -o

Active Connections

Proto  Local Address          Foreign Address        State           PID
TCP    127.0.0.1:2869         cmc2-PC:50485          TIME_WAIT       0
TCP    127.0.0.1:7112         cmc2-PC:57979          ESTABLISHED     15912
TCP    127.0.0.1:19872        cmc2-PC:49406          ESTABLISHED     4396
TCP    127.0.0.1:49406        cmc2-PC:19872          ESTABLISHED     4396
TCP    127.0.0.1:54982        cmc2-PC:54983          ESTABLISHED     25348
TCP    127.0.0.1:54983        cmc2-PC:54982          ESTABLISHED     25348
TCP    127.0.0.1:55704        cmc2-PC:55705          ESTABLISHED     17888
TCP    127.0.0.1:55705        cmc2-PC:55704          ESTABLISHED     17888
TCP    127.0.0.1:57979        cmc2-PC:7112           ESTABLISHED     24120
TCP    192.168.1.5:49757      wi-in-f189:https       ESTABLISHED     6876
TCP    192.168.1.5:49758      wi-in-f189:https       ESTABLISHED     6876
TCP    192.168.1.5:49978      lhr08s01-in-f14:https  TIME_WAIT       0
TCP    192.168.1.5:50216      lhr08s01-in-f18:https  ESTABLISHED     10260
TCP    192.168.1.5:50352      stackoverflow:https    ESTABLISHED     17888
TCP    192.168.1.5:50379      lhr08s01-in-f14:https  ESTABLISHED     6876
TCP    192.168.1.5:50400      cf-190-93-246-58:https  TIME_WAIT       0
TCP    192.168.1.5:50418      stackoverflow:https    ESTABLISHED     17888
TCP    192.168.1.5:50456      lhr08s02-in-f22:https  TIME_WAIT       0
TCP    192.168.1.5:50457      lhr08s02-in-f22:https  TIME_WAIT       0
TCP    192.168.1.5:50478      63.245.217.137:https   TIME_WAIT       0
TCP    192.168.1.5:50494      lhr14s22-in-f1:https   ESTABLISHED     6876
TCP    192.168.1.5:50495      lhr14s22-in-f1:https   ESTABLISHED     6876
TCP    192.168.1.5:57548      sjd-rc1-1a:http        ESTABLISHED     4396
TCP    192.168.1.5:63982      lhr08s02-in-f22:https  ESTABLISHED     17888
TCP    192.168.1.5:64658      ec2-54-73-215-205:https  ESTABLISHED     4760
TCP    192.168.1.5:65356      173.194.66.125:5222    ESTABLISHED     25348
TCP    [::1]:2869             cmc2-PC:50484          TIME_WAIT       0
  • ... PCI DSS is for credit card processors. This is the wrong site to ask such questions on. Truthfully, you don't seem to have much idea of what you're doing; stop thinking about DIYing credit card processing and either use a third party (e.g. PayPal, Stripe, etc.) and/or hire a professional. – Bob Jul 1 '14 at 8:24
  • 2
    This question appears to be off-topic because it is about issues specific to corporate IT support and networks, which is off-topic according to the help centre. – Bob Jul 1 '14 at 8:28
  • Running netstat on your PC is meaningless. The report specifically says that the problem is with the router, not your PC. You need to change the configuration of your router to stop hosting the admin page on port 80 and use HTTPS instead. – schroeder Jul 7 '14 at 15:12
6

Sorry to say it, but If you've failed a PCI-DSS on this - you've got a whole horde of problems. Not least that a home router (NETGEAR DG834G) doesn't have the necessary level of logging required for the PCI regression test which you will have to go through.

Further to this, the actual complaint in your message is that your router admin interface is available on HTTP instead of HTTPS - this is not something that cannot be changed on your router. Also, if you are running any web hosts on your PC, they should be using HTTPS with an externally signed certificate (not your own CA).

On top of this, you are required to have very strong encryption running - which you don't appear to have.

You need to invest some serious money, time and expertise that is clearly currently missing in order to pass PCI.

  • Thanks Fazer, Great input. that does make sense. I have always passed compliance testing in the past. I recently changed my faulty router for this one supplied by my broadband supplier. I will have to check but that may well be since the previous testing. Luckily we do not need very high levels of security because we don't run any e-commerce websites from our own equipment or store sensitive data etc. – user340171 Jul 1 '14 at 14:29

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for?Browse other questions tagged or ask your own question.