A bug has been found in the Secure Sockets Layer (SSL) 3.0 cryptography protocol (SSLv3) which could be exploited to intercept data that’s supposed to be encrypted between computers and servers. Three Google security researchers discovered the flaw and detailed how it could be exploited through what they called a Padding Oracle On Downgraded Legacy Encryption (POODLE) attack (CVE-2014-3566).
It is important to note that this is NOT a flaw in SSL certificates, their private keys, or their design but in the old SSLv3 protocol. SSL Certificates are not affected and customers with certificates on servers supporting SSL 3.0 do not need to replace them.
It’s believed to not be as serious as the Heartbleed bug in OpenSSL, since the attacker needs to have a privileged position in the network to exploit the latest. The usage of Hotspots, public Wi-Fi, makes this attack a real problem. This type of attack falls into the “Man-in-the-middle” category.
Background
While SSL 3.0 was introduced in 1996, it is currently supported by nearly 95% of Web browsers according toNetcraft’s latest report. Many Transport Layer Socket (TLS) clients downgrade their cryptography protocol to SSL 3.0 when working with legacy servers. According to Google, an attacker that controls the network between the computer and server could interfere with the handshake process used to verify which cryptography protocol the server can accept using a “protocol downgrade dance”. This will force computers to use the older SSL 3.0 protocol to protect data that is being sent. Attackers can then exploit the bug by carrying out a man-in-the-middle (MITM) attack to decrypt secure HTTP cookies, which could let them steal information or take control of the victim’s online accounts. Although, at the time to writing, webmasters have been disabling moving to TLSv1 and above and a rapid pace, there still remains a lot of work to be done. If Heartbleed taught us anything, it’s that the largest companies act fast while many small companies drag their heels in patching critical vulnerabilities.
What Businesses Need to Do
In order to mitigate the bug there are a few courses of action:
- Check to see if your webservers are vulnerable using our free SSL Toolbox.
- Use tools that support TLS_FALLBACK_SCSV, a mechanism that prevents attackers from forcing Web browsers to use SSL 3.0.
- Disable SSL 3.0 altogether, or disable SSL 3.0 CBC-mode ciphers
- A cloud-based Web Application Firewall can help protect against this kind of vulnerability. For more information please visit our website.
- Be leery of any spam messages from scammers trying to capitalize on uncertainty and a lack of technical knowledge.
A few tips on how to fix this on Apache:
> SSLProtocol All -SSLv2 -SSLv3 <- Removes SSLv2 and SSLv3
> apachectl configtest <- Test your configuration
> sudo service apache restart <- Restart server
Google added that it will remove SSL 3.0 support from all of its products in the next few months. Mozilla also said it would disable SSL 3.0 in FireFox 34, which will be released at the end of November.
What End-Users Need to Do
For end-users accessing websites Symantec recommends:
- Check to see if SSL 3.0 is disabled on your browser (for example, in Internet Explorer it is under Internet Options, Advanced Settings).
- Avoid MITM attacks by making sure “HTTPS” is always on the websites you visit.
- Monitor any notices from the vendors you use regarding recommendations to update software or passwords.
- Avoid potential phishing emails from attackers asking you to update your password – to avoid going to an impersonated website, stick with the official site domain.
Source: symantec
No Comment to " POODLE Security Vulnerability Breaks SSLv3 Secure Browsing "