POODLE attack shows that all SSLv3 connections are insecure

[Exterminator]

Content source

http://www.neowin.net/news/poodle-attack-shows-that-all-sslv3-connections-are-insecure

Is Internet security crumbling around us? With all of the recent issues, it sure seems like it. From Heartbleed impacting OpenSSL connections, to Shellshock impacting most of the web, to the constant reports of stolen personal data, it feels like security professionals are losing the war against the bad guys.

The latest issue comes from a trio of Google researchers who have announced an attack on SSLv3 called POODLE. Short for, "Padding Oracle On Downgraded Legacy Encryption," the attack can be used to downgrade a connection from the TLS standard and instead force an SSLv3 connection, which can then be attacked to steal cookie information. Once the cookie is obtained, the attacker could potentially impersonate a user session for themselves.

It's important to note that SSLv3 has been around for nearly 15 years and has been replaced by TLS 1.0, 1.1, and 1.2. However, older browsers, like Internet Explorer 6, aren't designed to handle the newer encryption standards, and therefore web servers (and browsers) have left the old version around for compatibility purposes.

Since the SSLv3 protocol is no longer secure, it is now being phased out of browsers. Google announced that they will be removing support for the SSLv3 "in the coming months," while Mozilla stated that it will be removed in Firefox 34 which will be released on November 25th.

Overall, this isn't a big deal for most end users, especially once the browsers remove compatibility for the older standard. For people managing servers, there will be some scrambling over the next few days to try and remove support while minimally impacting customers.

Source: Google | Poodle image courtesy of Shutterstock

 

[Petrovic]

From the researchers that brought you BEAST and CRIME comes another attack against Secure Sockets Layer (SSL), one of the protocols that's used to secure Internet traffic from eavesdroppers both government and criminal.

Calling the new attack POODLE—that's "Padding Oracle On Downgraded Legacy Encryption"—the attack allows a man-in-the-middle, such as a malicious Wi-Fi hotspot or a compromised ISP, to extract data from secure HTTP connections. This in turn could let that attacker do things such as access online banking or e-mail systems. The flaw was documented by Bodo Möller, Thai Duong, and Krzysztof Kotowicz, all who work at Google. Thai Duong, working with Juliano Rizzo, described the similar BEAST attack in 2011, and the CRIME attack in 2012.

The attack depends on the fact that most Web servers and Web browsers allow the use of the ancient SSL version 3 protocol to secure their communications. Although SSL has been superseded by Transport Layer Security, it's still widely supported on both servers and clients alike, and is still required for compatibility with Internet Explorer 6. SSLv3, unlike TLS 1.0 or newer, omits validation of certain pieces of data that accompany each message. Attackers can use this weakness to decipher an individual byte at time of the encrypted data, and in so doing, extract the plain text of the message byte by byte.

Full Article

 

[Petrovic]

POODLE Test
If you see a poodle below, then your browser supports SSLv3 and you maybe vulnerable. If you see a Springfield Terrier below, your browser doesn't support SSLv3.
https://www.poodletest.com/