Sweet32: Birthday attack on 64-bit block cipher - Withdrawal of 3DES cipher support for all Zoho services - 31/01/2017

Sweet32: Birthday attack on 64-bit block cipher - Withdrawal of 3DES cipher support for all Zoho services - 31/01/2017

Zoho always tries to provide utmost security and privacy to our users and here is one such instance. This is about removing weak and insecure ways to access our platform and strengthening it based on industry standard recommendations from time to time.


3DES,  a 64-bit block cipher,  is one of the algorithms used for encryption. These block ciphers, with short block size, are vulnerable to a type of  cryptographic attack, known as the Birthday Attack. Due to this vulnerability, all Zoho services will stop extending support to 3DES from January 31, 2017.


After Zoho disables 3DES cipher, any communication with a Zoho service will need to use AES (128/256) cipher for encryption. All modern browsers/clients and operating systems support robust algorithms like AES. In order to avoid issues connecting with Zoho services, we advice our users to stay up-to-date and update to such latest systems.


1) Internet Browsers:

We monitored our traffic and observed that around 98% of users connecting via 3DES are using IE on Windows XP or Windows 2003 server. These legacy systems do not support AES based ciphers by default. As these systems are no longer supported by its vendor, we  recommend our customers to upgrade their OS or at least use latest   browsers like Firefox/Chrome.

 

2) API Integrations:
If your APIs use 3DES cipher to access Zoho's Applications, please update your API to connect via AES(126,256). Refer the following to set the cipher suite for the language you are using:

 

Java     - Set the cipher suite in javax.net.ssl.SSLSocket.

Ruby    - Set the preferred cipher suite in OpenSSL::SSL::SSLContext

PHP     -  Set CURLOPT_SSL_CIPHER_LIST to a list cipher suites that uses AES for encryption to your Curl options.

Python - Set the cipher suite in SSLContext.set_ciphers.

c#        - Use CipherAlgorithmType AES.

 

You can also refer SSLLabs to check whether you will be affected by this measure. Do get in touch  with the respective Zoho product team in c ase you have any queries.

Take  these measures right away so that you are not affected by this attack.  To know more about the sweet32 vulnerability, refer : https://sweet32.info/
    • Sticky Posts

    • Zoho MVP Batch of 2023

      Image: Zoho MVP Batch of 2023 Presenting the Zoho MVPs for 2023: Michael Trow Damien Cregan Kevin Flynn Donald Love Gordon Mankelow Abhishek Sharma Nik Khairul Bryan Pape Hugh Marshall Bhoomi Joshi Mikhail Koval Ken Florian Sven Rösser Our MVPs are passionate
    • Thanksgiving 2022 - Celebrating Zoho Community SuperBuds

      One of the things we love most about our Zoho User Community is how readily our users help each other out, and share their Zoho and business knowledge. Be it the community forums, the virtual and in-person meetups, or Zoholics, it's been heart-warming
    • Zoho MVP Batch of 2022

      Image: Zoho MVP Batch of 2022 Zoho MVPs are passionate customers and partners who go out of their way in helping the community members. With their significant contributions in the community forums, they help cut short the learning curve of the members,
    • ZOHO-20 to fight COVID-19

      While the world economy is taking a hit, we, at Zoho, are doing our bit to help small businesses come out of this crisis. Here are all the programs and packages offered by Zoho to fight Covid-19. 1. ESAP: The Small Business Emergency Subscription Assistance Program (ESAP) gives our severely impacted small business customers access to Zoho software they currently use, free for three months. All Zoho customers with 25 employees or fewer who have been severely impacted by the coronavirus-related downturn
    • ​Issues with Forum posts approval in Zoho Community

      Hi All, Issue: Some of you have reported that the posts/comments made today are going for moderation. The issue started few hours ago, and the behaviour was reported in CRM and Creator Forums by a few customers/partners. We were able to see the same problem in a few other product forums too. How it impacts you: Don't worry if you find that your posts and comments are stuck in moderation. Your posts/comments are safe. Please don't duplicate them. We're keeping a tab on the development and approving
    • Recent Topics

    • How to upload mass inventory quantity adjustment with batch number?

      I wanted to clean-up our inventory list; however, I have trouble performing the task as I don't know how to mass upload inventory adjustment with batch numbers. I don't want to do it manually as there are if not thousands at hundreds of inventory tr
    • Product sale report with margins

      we unable to get the data as per product sale report with margins so we need help in this
    • CLIENT PORTAL (If clients can place orders directly on the portal)

      Zoho client portal is excellent. Everything is there except one thing. Client should be able to place orders directly on the portal. This would enhance the portal and end users will be extremely happy. This suggestion infact came from one of our client.
    • Is there provision to charge the attendees to join the webinar?

      We want to host some webinar of public interest and want to charge them to participate in this. Does this feature in-build in the application? Offcourse, we will be having Razor pay account activated for these purpose.
    • Zoho Vault App for Windows

      Hello, is there a Windows app that can be used to access the passwords saved in Zoho Vault? Thank you
    • Emails take up to 14 hours to arrive and often never arrive at all.

      I've been on hold on your support phone for two hours. I spent an hour waiting to talk to somebody somebody finally picked up. They asked me to give them my ID number and when I found it, they were gone they didn't hang up. They just walked away from
    • Emails take up to 14 hours to arrive and often never arrive at all.

      I've been on hold on your support phone for two hours. I spent an hour waiting to talk to somebody somebody finally picked up. They asked me to give them my ID number and when I found it, they were gone they didn't hang up. They just walked away from
    • Print PO receipt

      Hi I would like to print the PO receipt. There does not seem to be any way to do this. I track batch numbers and printing the PO does not show this. Only the receipt would show the details of the receipt. Currently I print the screen which does not have
    • How can the direct link to a ticket be created from ticket #?

      Our agents will be using ZDesk but we will have to create direct link to tickets in another ERP by providing the Desk Ticket # Is there a way to create the direkt links from the ticket # alone? Do we have to use the API to get the direct links?
    • Allow standard layout to be used/edited as a starting point for canvas

      Hello, I would really love to improve the look of our CRM interface using Canvas but we have spent so much time customising the screens already (in standard view) that the thought of starting from scratch and building everything again, field by field,
    • How to link to/displaya png stored in workdrive in a Creator HTML snippet?

      How to link to/display png stored in workdrive in a Creator HTML snippet? I've tried it as a plain external link and as an iframe. The iframe works but is kinda slow...and I'd prefer to be able to do finer-grained positioning but referencing the png as
    • Has anyone built a ticket export that allows Help Center users to export the tickets shown in the My Area list they are looking at?

      Hi, We are moving to Zoho Desk soon. Our current support system displays an option in our help center allowing customers to export their Open, Closed, or all tickets based on which list they are looking at. We need to offer the same in Zoho Desk help
    • Contemplating moving my site from WordPress to Zoho Sites

      Hi Everyone, We currently find ourselves in a situation where we ant to review and update our current sites content. We are small business owners, not developers. We currently use a wide range of Zoho products. We sometimes think about the possibility of either moving or just starting from scratch on Zoho Sites. I would like to know if anyone has done this and of course the things that need to be considered. We have spent quite a bit of time getting our current site positioned organically and I guess
    • Using AVG in SQL Query

      My current SQL Query is: SELECT "Client Info", avg("Revenue") FROM "Funded Deals" GROUP BY "Client Info" The current table that this is creating: Client Info avg(Revenue) Previous 4175 1st - New 3411 1st - Old 3013 Renew 3069 While this works as I had
    • Unified customer portal login

      As I'm a Zoho One subscriber I can provide my customers with portal access to many of the Zoho apps. However, the customer must have a separate login for each app, which may be difficult for them to manage and frustrating as all they understand is that
    • Tracking Implementations

      We create Opportunities (Renamed Deals) with associated Quotes (renamed Products and Services). When we close the deal, we want to be able to track the implementation of each product separately. For instance, the client may have ordered Item A, Item B
    • Is this link the transparent pixel used to track opens?

      Could someone please help me identify this highlighted link? It is automatically created by Zoho and a lot of contacts receiving campaigns will click on this link. I don't believe that it is the "update your preferences link" because on the Link Clicks
    • Zoho desk desktop application

      does zoho desk has a destop applicaion?
    • How can I view Help Center articles in 'Sandbox' mode?

      I have published some help center articles but when I try to preview the knowledge base page, it says 'We have no content to display'.
    • Is this possible with Campaigns?

      My company is currently moving CRM's from Monday to Zoho One. Currently, our marketing lead process is send out 7 sms messages over 14 days if the lead is in a certain status. If we don't get a response the lead is put into a "Closed" status. Do we buy
    • Tracking leads through the sales process

      Our leads are being generated via paid google ads and are arriving to us with UTM data showing lead sources, campaign mediums and campaign names. I want to track the progress of those leads as they migrate through our sales funnel while maintaining a
    • Error 403: Forbidden When Updating Email Signature via API

      Hi Zoho Desk team, First, congratulations again on the excellent Zoho API. But, I’m encountering an issue while attempting to update an email signature via the API. Whenever I make a request to update the signature, the response returns an HTTP 403 Forbidden
    • Opening & working multiple tickets

      We work in multiple tickets at the same time. Currently to do this, we have to open multiple instances of Desk.  Is there a way to do this by just opening multiple ticket tabs within 1 instance of Desk?  
    • Different content per social media account..

      Is there a way to add different content per social media account on one post?
    • Merge tickets

      Hello, I am attempting to merge two tickets; however, the option to merge does not appear to be available. Could you kindly confirm if this feature has been relocated or removed? Additionally, could you please provide guidance on the correct process to
    • Add "Merge by Ticket ID" Option on Ticket Screen

      Dear Zoho Team, We would like to request a new feature for the ticket interface in Zoho Desk. Specifically, we propose adding a button to the ticket screen that allows users to merge the current ticket with another ticket by directly providing the second
    • Using tickets to train Zia

      Hi Team, I would like to know if there is any way that Zia can also learn from previous tickets in addition to the articles from the knowledge base. Since we have most of our knowledge curerently in the tickets and that this is hard to combine into a
    • Unable to delete Junk Lead and Not Qualified from the Lead Status field

      Are Junk Lead and Not Qualified default fields or something that cannot be deleted? I have gone into the Leads module and made sure there are no records using these values. Other values have a minus sign that allows me to remove them, but these two fields do not have that option.
    • Welcome Link Expired

      Hi The links sent to the users didn't get clicked on in time and now all the links have expired. Is there a way to send a new link without deleting them and re-adding them>
    • Zoho Developer Community Monthly Digest - December 2024

      Hello everyone! As we step into the new year, let’s reflect on the strides we’ve made together and gear up for the exciting opportunities 2025 holds. This month’s digest highlights key updates, engaging discussions, and upcoming events designed to keep
    • Allow "add new" option to picklists and multiselection fields from add or edit pages

      Hello zoho, please insert an add option (ie +)sign) to pick and multiselect fields so we can add new options while entering or editing records. For example. in my lead module, while adding a new record, I realized I had a new lead source. I went to my
    • Enhancements to Zoho Corp Help Center "Team Requests" View

      Dear Zoho Team, I hope this message finds you well. The ability to view both my tickets and my team’s tickets in the Zoho Corp Help Center is a fantastic feature, especially as the focal point for Zoho in our organization. However, we’ve encountered a
    • We've revised the pricing model of CRM portal user licenses

      Hello everyone, We’re making important updates to our pricing structure for portal user licenses, effective from the next payment cycle. The new slab-based pricing is as follows: Previously, these portal user licenses were priced at $5/ user/ month. As
    • Zoho and Hostaway webhok integration.

      I want to receive data coming from hostaway webhook and receive it in zoho crm to create or update record in a module based on conditions. The hostaway webhook sends data every time a reservation is created or modified or cancelled. The hostaway sends
    • Unable to create custom fields for shipment order

      I'm unable to create custom fields for shipment orders, even though the custom fields are set up correctly. A request to the following endpoint: https://www.zohoapis.com/inventory/v1/settings/preferences/customfields?organization_id=${ZOHO_ORGANIZATION_ID}&entity=shipment_order
    • Records per page in New UI

      It seems the new UI lack of "Records per page" function, it is very handy if you are looking for a data that you don't know the exact search term, but you know it may "between" few entries. without a "page" function, we kind of have to keep page down and page, the autoload is not that fast, and you are dealing with thousands of entries. Could we please have the "records per page" function back to New UI (also it shows total counts of the record) Looking forward to hear from you.
    • zet pack not working

      We are using the zet pack command to package our Zoho extension. However, after running the command, the extension gets packed, but the resulting package is empty. We've attached a screenshot for reference. Could you please assist us with resolving this
    • CSV File Added to Form - Parse and Map to Fields

      Hi,  I apologize, I can't seem to find a clear explanation or help article on how to parse a CSV file. On validate, I process this deluge script. fileContent = Collection(input.File_upload.content); result = fileContent.values(); info result; What I want to do is create a record (in another form), and map certain fields to fields in the form.  I can get values, which is the whole file but no keys. If I use result = fileContent.keys(); I get "0" As you can see from CSV, my first line is my map and
    • Encountered an error while creating a bill in Zoho Inventory: {"code":6,"message":"Invalid data provided"}

      I attempted to create a bill using the Zoho Inventory API, but I received an error: {"code":6,"message":"Invalid data provided"}. However, when I made the same request again, it was successful. Does anyone have insights on why this happened?
    • Why do I need to send the Customer ID in the Create Purchase Order Request?

      I'm trying to create a purchase order using this endpoint https://www.zoho.com/inventory/api/v1/purchaseorders/#create-a-purchase-order Unfortunately, I'm getting this error { "code": 4, "message": "Invalid value passed for Customer ID" } The doc doesn't
    • Next Page