POODLE Attack?
A POODLE attack is an exploit that takes advantage of the way some browsers deal with encryption. POODLE (Padding Oracle On Downgraded Legacy Encryption) is the name of the vulnerability that enables the exploit.
POODLE can be used to target browser-based communication that relies on the Secure Sockets Layer (SSL) 3.0 protocol for encryption and authentication. The Transport Layer Security (TLS) protocol has largely replaced SSL for secure communication on the Internet, but many browsers will revert to SSL 3.0 when a TLS connection is unavailable. An attacker who wants to exploit POODLE takes advantage of this by inserting himself into the communication session and forcing the browser to use SSL 3.0.
The attacker is then free to a exploit design flaw in SSL 3.0 that allows the padding data at the end of a block cipher to be changed so that the encryption cipher become less secure each time it is passed. To prevent a POODLE attack that forces a browser to degrade to SSL 3.0, administrators should check to see that their server software supports the latest version of TLS and is configured properly.
only way to prevent POODLE attacks is to stop using SSL 3.0. Google and Firefox have already announced that they will be removing support in the future, and while we haven’t (yet) heard the same from Microsoft, it’s extremely easy as an end-user to disable SSL 3.0 in IE. Most of the large web companies are removing support for SSL after this problem came to light, but it will take a while for everybody to do so.
POODLE can be used to target browser-based communication that relies on the Secure Sockets Layer (SSL) 3.0 protocol for encryption and authentication. The Transport Layer Security (TLS) protocol has largely replaced SSL for secure communication on the Internet, but many browsers will revert to SSL 3.0 when a TLS connection is unavailable. An attacker who wants to exploit POODLE takes advantage of this by inserting himself into the communication session and forcing the browser to use SSL 3.0.
The attacker is then free to a exploit design flaw in SSL 3.0 that allows the padding data at the end of a block cipher to be changed so that the encryption cipher become less secure each time it is passed. To prevent a POODLE attack that forces a browser to degrade to SSL 3.0, administrators should check to see that their server software supports the latest version of TLS and is configured properly.
only way to prevent POODLE attacks is to stop using SSL 3.0. Google and Firefox have already announced that they will be removing support in the future, and while we haven’t (yet) heard the same from Microsoft, it’s extremely easy as an end-user to disable SSL 3.0 in IE. Most of the large web companies are removing support for SSL after this problem came to light, but it will take a while for everybody to do so.
As a consumer, you can remove support for SSL from your browser or if you are using Firefox or Google Chrome and aren’t using hotspots all the time, you could wait for them to update the browser. Or you can make sure that you’ve fixed the problem yourself.
Comments
Post a Comment